Google gVisor: Use-after-free in VFS allows code execution in sentry process
Summary
A use-after-free in the virtual filesystem (VFS) of Google gVisor allows a local attacker with standard container privileges to execute code in the host sentry process. The attacker triggers a double free of the backing MemoryFile of an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries, and the CNA rates exploitation as not automatable.
Affected
- Google gVisor releases prior to 20260831.0, on all platforms
- Distribution packages: status unclear (Ubuntu lists golang-gvisor-gvisor as 'Needs evaluation')
Fixed in
- Upgrade to gVisor 20260831.0 or later (the latest release is recommended)
- Fix commits: 25c75149bc0eeaa6a3a49b9bbe3473588b2af6df, 90bc4fc36fe442257a06ba15df00371561c183ed, e4efb89c787ef15b09e68d561f1303380e1d5a77
- Which commit landed in which release: Unknown.
Workaround
Unknown. No vendor workaround was found.
Exploitation
- No evidence of exploitation in the wild or public proof-of-concept found in research.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS 0.00084 (third-party aggregator).
- Not checked against CISA KEV.
Our recommendation
- Check whether gVisor (runsc), a Kubernetes sandbox runtime or a managed sandbox service is in use.
- Upgrade gVisor to 20260831.0 or later; for distribution packages, track vendor status and consider the upstream binary.
- Do not run untrusted containers on shared hosts until patched.
- Priority: medium for single-tenant SMEs; higher for hosting providers, multi-tenant clusters and CI systems running untrusted code.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- gVisor fix commit 25c75149 (overlayfs refcount panic) github.com
- gVisor fix commit 90bc4fc3 (mount namespace checks) github.com
- gVisor fix commit e4efb89c github.com
- OSV record CVE-2026-95702 osv.dev
- Ubuntu security tracker CVE-2026-95702 ubuntu.com
- gVisor releases github.com
- gVisor release 20260831.0 (sourceforge mirror) sourceforge.net
- gVisor filesystem documentation gvisor.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:01.
Original description (NVD)
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.