---
id: CVE-2026-112917
title: Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall
summary: >-
  In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux
  container can use 32-bit socketcall to bypass the default seccomp restriction
  on AF_VSOCK. This can expose host-facing services and Windows files accessible
  to th…
severity: critical
cvss: 9.2
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N'
cvssSource: cna
cwe:
  - CWE-424
vendor: Docker
product: Docker Desktop
affected:
  - desktop (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-04T04:56:32.458790Z'
published: '2026-11-03'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T13:33:36.124Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112917'
references:
  - url: 'https://docs.docker.com/desktop/release-notes/#4980'
    label: Docker Desktop release notes
  - url: 'https://github.com/microsoft/WSL/releases/tag/3.0.3'
    label: Microsoft WSL 3.0.3 release notes
  - url: >-
      https://github.com/microsoft/WSL2-Linux-Kernel/releases/tag/linux-msft-wsl-6.18.54.1
    label: Microsoft WSL kernel 6.18.54.1 dependency release notes
tags:
  - cve.org
epss: 0.00184
epssPercentile: 0.08106
ingestedAt: '2026-11-05T20:33:06.736Z'
---

## Overview

In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.

## Affected

- `desktop (all versions)`

## Remediation

Upgrade to Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Both are required.