CVE-2026-95702
High
Description
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.
SeverityHigh
CVSS8.5
Exploit probability—
Product
gVisor
PublishedOct 9, 2026
First seenOct 9, 2026
Weakness typeCWE-416Use after freeCWE-415CWE-415
How to fix
Update
- Google gVisor20260831.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google gVisor | v < 20260831.0 | 20260831.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.