{"type":"bundle","id":"bundle--ed39e076-4794-5f8f-800c-9dd37b84956c","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--7f56357c-7f77-589f-bae0-46835195def1","created":"2026-11-03T19:38:14.890Z","modified":"2026-11-03T19:38:14.890Z","name":"Docker Desktop for Windows on WSL 2: a container can slip past the AF_VSOCK block and reach host services and Windows files (CVE-2026-112917)","description":"CVE-2026-112917 (CVSS 4.0 9.2 from Docker, CWE-424) was published on 2026-11-03 alongside Docker Desktop 4.98.0. In Docker Desktop for Windows with the WSL 2 backend, an unprivileged Linux container can use the 32-bit socketcall system call to bypass the default seccomp restriction on AF_VSOCK, which can expose host-facing services and Windows files accessible to the logged-in user. It affects x86-64 WSL 2; LinuxKit-based backends are unaffected. Docker says the issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later (released 2026-10-09 with WSL kernel 6.18.54.1); Docker Desktop 4.98.0 on an older WSL remains affected. The upstream moby default seccomp profile allows socket() only for listed address families (AF_VSOCK, 40, is not listed) but allows socketcall with no argument filter and includes the 32-bit x86 sub-architecture. Not on CISA KEV and no known exploitation as of 2026-11-03.","aliases":["CVE-2026-112917","Docker Desktop WSL2 AF_VSOCK bypass","Docker Desktop 32-bit socketcall seccomp bypass","Docker Desktop 4.98.0 security fix"],"first_seen":"2026-11-03T19:17:53.000Z","last_seen":"2026-11-03T19:25:48.000Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Docker Desktop 4.98.0 release notes","url":"https://docs.docker.com/desktop/release-notes/#4980"},{"source_name":"NVD CVE-2026-112917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112917"},{"source_name":"Microsoft WSL 3.0.3 release","url":"https://github.com/microsoft/WSL/releases/tag/3.0.3"},{"source_name":"WSL2 Linux kernel linux-msft-wsl-6.18.54.1 release","url":"https://github.com/microsoft/WSL2-Linux-Kernel/releases/tag/linux-msft-wsl-6.18.54.1"},{"source_name":"moby default seccomp profile","url":"https://github.com/moby/profiles/blob/main/seccomp/default.json"},{"source_name":"HOL: Docker Desktop on WSL 2 lets a container reach the Windows host (CVE-2026-112917)","url":"https://hol.org/blog/cve-2026-112917-docker-desktop-wsl2-vsock-isolation-bypass"}]}]}