{"schemaVersion":3,"id":"CVE-2026-95702","aliases":["DEBIAN-CVE-2026-95702","UBUNTU-CVE-2026-95702"],"status":"published","duplicateOf":null,"title":null,"description":"Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.","dates":{"published":"2026-10-09T14:44:35.711Z","modified":"2026-10-15T18:15:18.924Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.5,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.5,"severity":"high","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Debian","score":8.5,"severity":"high","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.5,"severity":"high","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":8.5,"severity":"high","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true}]},"epss":{"probability":0.00084,"percentile":0.0024,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-10T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00084,"percentile":0.0024}],"last30":[{"date":"2026-10-10T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00084,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00084,"percentile":0.0024}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-415","name":"Double Free","description":"The product calls free() twice on the same memory address.","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/415.html"},{"id":"CWE-416","name":"Use After Free","description":"The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","type":"weakness","status":"Stable","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/416.html"}],"affected":[{"vendor":"debian","product":"golang-gvisor-gvisor","name":"golang-gvisor-gvisor","label":"golang-gvisor-gvisor","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/golang-gvisor-gvisor","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"golang-gvisor-gvisor","name":"golang-gvisor-gvisor","label":"golang-gvisor-gvisor","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/golang-gvisor-gvisor","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"google","product":"gvisor","name":"gVisor","label":"gvisor","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 20260831.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 20260831.0","eol":null,"hubHref":"/vendor/google/gvisor"}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/google/gvisor/commit/90bc4fc36fe442257a06ba15df00371561c183ed","label":"github.com/google/gvisor/commit/90bc4fc36fe442257a06ba15df00371561c183ed","hostname":"github.com","tags":["REPORT"]},{"url":"https://github.com/google/gvisor/commit/25c75149bc0eeaa6a3a49b9bbe3473588b2af6df","label":"github.com/google/gvisor/commit/25c75149bc0eeaa6a3a49b9bbe3473588b2af6df","hostname":"github.com","tags":["REPORT"]},{"url":"https://github.com/google/gvisor/commit/e4efb89c787ef15b09e68d561f1303380e1d5a77","label":"github.com/google/gvisor/commit/e4efb89c787ef15b09e68d561f1303380e1d5a77","hostname":"github.com","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-95702","label":"security-tracker.debian.org/tracker/CVE-2026-95702","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-95702","label":"ubuntu.com/security/CVE-2026-95702","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95702","label":"www.cve.org/CVERecord?id=CVE-2026-95702","hostname":"www.cve.org","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-09T14:44:35.711Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-15T18:15:18.924Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":34,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T06:41:43.646Z","stale":false,"partial":false}}