Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall

Docker Desktop's isolation can be broken to peek at Windows files!

Summary

On Windows, Docker Desktop's WSL2 backend lets an unprivileged Linux container bypass isolation and reach host-facing services and Windows files the logged-in user can access. It affects x86-64 WSL2; LinuxKit-based backends are unaffected.

Affected when

WSL2 backend in use
x86-64 WSL2
WSL older than 3.0.3

What to do

Update Docker Desktop to 4.98.0 or later and WSL to 3.0.3 or later. Both are needed for a full fix.

Products and platforms

Windows
Docker Desktop

CVE IDs

CVE-2026-112917 (opens in a new tab)

Sources

Advisory: docs.docker.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 19:08 UTC

First seen 2026-11-09 14:50 UTC