CVE-2026-112917: Docker Desktop, AF_VSOCK isolation bypass

CVE-2026-112917 affects Docker Desktop for Windows and targets the WSL2 backend on x86-64 architectures. An unprivileged Linux container can exploit 32-bit socketcall invocations to bypass seccomp restrictions on AF_VSOCK sockets, thereby gaining access to host-facing services and Windows files accessible to the logged-in user. LinuxKit-based backends are not affected by this vulnerability.

The CVSS score is 9.2 (Critical), indicating severe impact, though the officially declared severity has been labeled as 'medium' in available data—a discrepancy that administrators should watch for official clarifications. The vulnerability was published on NVD 2026-11-03 and is accompanied by a verified patch. Signals on X show 3 posts in the past 24 hours, reflecting community interest; however, some messages incorrectly describe the patch status.

Complete remediation requires simultaneous upgrade to Docker Desktop 4.98.0 (or later) and WSL 3.0.3 (or later). If Docker Desktop has been upgraded to 4.98.0+ but WSL remains older, the system remains vulnerable. IT teams should verify current versions of both components and coordinate updates. It is also recommended to audit the execution of containers whose origin is not certain, particularly in shared development environments.