Google gVisor CVE-2026-95702

Exploitation requires the attacker to already have standard (unprivileged) container-user access inside a running gVisor sandbox on a vulnerable build (prior to release 20260831.0, all platforms), and the ability to create and manipulate an in-sandbox overlay filesystem to drive the backing MemoryFile into a double-free. The upstream patch pinpoints the trigger: binding a lazily-detached mount (held open via an fd re-referenced through /proc/self/fd after umount2 MNT_DETACH) to another mount point, exercising the nsfs/cgroupfs/cgroup2fs bind path in VFS. Limiting factors that reduce real-world risk: it is local-only with no network vector, needs authenticated in-sandbox code execution (PR:L), and the resulting code execution lands in a sentry process that is still boxed in by host Linux seccomp and namespace restrictions, so a single exploitation does not automatically reach the host kernel or other tenants.

This is a credible, exploitation-worthy container-escape primitive but not an emergency-patch-tonight issue for most environments. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms it is strictly local and requires already holding standard privileges inside a gVisor sandbox - there is no network-reachable path, which substantially caps mass-exploitation potential. Technical impact is high (VC:H/VI:H/VA:H): a use-after-free/double-free (CWE-416) yielding code execution in the host-side sentry process, i.e. compromise of the sandbox's own security monitor. Importantly, both the description and the CVSS author constrain the blast radius: SC:N/SI:N/SA:N and the explicit note that 'the sentry process remains confined by host-level Linux seccomp and namespace boundaries' mean this escapes the guest into the sentry but NOT (by itself) onto the host OS - it is a sandbox-integrity break, not a full host takeover. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active or at-scale exploitation; the signal set is 'serious capability, no observed exploitation.' The strongest corroboration is the three upstream fix commits with regression tests, confirming the bug is real and vendor-acknowledged. Net: prioritize patching for multi-tenant gVisor deployments where untrusted workloads share a host, but treat it as a defense-in-depth erosion rather than an immediately weaponized threat.

An attacker who already has a foothold with ordinary user privileges inside a gVisor-sandboxed container crafts an in-sandbox overlay filesystem and manipulates its backing MemoryFile so it is freed twice, corrupting sentry memory. By controlling the reused allocation they hijack execution in the host sentry process, breaking out of the guest's intended isolation. No public exploit code was identified at time of analysis, though the upstream patch and its regression tests disclose the triggering mount sequence.