CVE-2026-95702

A flaw was found in Google gVisor's Virtual File System (VFS). A local attacker with standard container privileges can exploit this vulnerability to achieve arbitrary code execution within the host sentry process. By improperly releasing a backing memory file multiple times from an in-sandbox overlay filesystem, the attacker triggers a use-after-free memory corruption condition. While code execution occurs in the sentry process, the process remains restricted by host-level security filters and namespace boundaries.

A use-after-free vulnerability in Google gVisor's Virtual File System (VFS) allows a local attacker with standard container privileges inside a gVisor sandbox to trigger a double-free of the backing MemoryFile of an in-sandbox overlay filesystem, causing memory corruption and arbitrary code execution within the host sentry process. The sentry process remains confined by host-level Linux seccomp filters and namespace boundaries, so code execution does not directly translate into escape to the wider host. Red Hat evaluates this flaw as IMPORTANT severity (CVSS 3.1 score 7.8); the CVEORG record assigns a CVSS 4.0 score of 8.5 (also IMPORTANT), a difference attributable to the scoring methodology rather than a material difference in severity.

No Red Hat-maintained component is listed as affected. The components that vendor portions of the gVisor source -- gvisor-tap-vsock and podman in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform, as well as Fedora community packages such as rootlesskit, headscale, spoofdpi, nebula, and tailscale -- are all recorded as NOT AFFECTED because the vulnerable VFS overlay/MemoryFile code is not present in those builds; these components consume only parts of the gVisor library rather than the gVisor sandbox runtime itself.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.