CVE-2026-95702 — Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code exec…
Published: 2026-10-09 · CVSS: 8.5 · CVSS 4.0
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7