PT-2026-98870
CVE-2026-96812
·
Published
2026-09-25
·
Updated
2026-10-09
Description by
CVSS 4.0
8.8
HighMetricsAV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Google gVisor versions prior to commit 573a9e73cf844f
Description
An improper exposure of resource to the wrong sphere exists in the host file helper (gofer) on Linux platforms with CUSE (Character device for Userspace) enabled. A local attacker with container image deployment privileges can achieve root code execution on the host system by including a
/dev/cuse character device node in a container image. Opening this device allows the sandboxed attacker to register a host device and exploit unrestricted ioctl (input/output control) handling to overwrite root udev helper memory.Recommendations
Update Google gVisor to commit 573a9e73cf844f or a later version.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾