CVE-2026-112917: Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AFVSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Docker Desktopto a version that resolves this vulnerability.Fixed in 4.98.0 - Upgrade
Upgrade
WSLto a version that resolves this vulnerability.Fixed in 3.0.3
Event History
Frequently Asked Questions
Which environments are affected?
The issue affects Docker Desktop for Windows using the WSL2 backend on x86-64 WSL2. LinuxKit-based backends are unaffected.
What access does an attacker need?
An attacker needs the ability to run code in an unprivileged Linux container. No user interaction is required.
What could an attacker reach after exploitation?
The bypass can expose host-facing services and Windows files that are accessible to the logged-in Windows user.
Is updating Docker Desktop alone sufficient?
No. Full remediation requires Docker Desktop 4.98.0 or later and WSL 3.0.3 or later; Docker Desktop 4.98.0 or later remains affected when running on an older WSL version.