Vulnerability · Published Sep 25, 2026 · Assigned by Google
CVE-2026-96812Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE
High 8.8
In plain English
A high-severity privilege mismanagement in gVisor from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-gvisor-gvisor | no fix listed | DEBIAN-CVE-2026-96812 |
| Debian:13 | golang-gvisor-gvisor | no fix listed | DEBIAN-CVE-2026-96812 |
| Debian:14 | golang-gvisor-gvisor | 0.0~20261026.0-1 | DEBIAN-CVE-2026-96812 |
Affected products (as reported)
Weakness: CWE-668, CWE-269 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H