CVE-2026-96812

Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE

State: Published
Severity: 8.8 High
Published: Sep 25, 2026
Updated: Sep 25, 2026
Reserved: Sep 23, 2026

Description

Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.

Scores

CVSS	Score	Vector	Source
4.0	8.8 High	CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	Google

Weaknesses

CWE-668 Exposure of Resource to Wrong Sphere
CWE-269 Improper Privilege Management

Affected Products

Product	Versions
gVisorGoogle	before 573a9e73cf844fAffected

References

https://github.com/google/gvisor/commit/573a9e73cf844f

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.