gVisor CVE-2026-96812

Requires all of: (1) a gVisor build prior to commit 573a9e73cf844f; (2) the host running a Linux platform with CUSE (Character Device in Userspace) enabled; (3) the pre-fix character-device passthrough behavior, where opening a char device node in the sandbox is dispatched to the host gofer rather than the sentry's emulated device registry (the fix makes emulated-only the default); and (4) the attacker holding container-image deployment privileges so they can embed a /dev/cuse device node in the image. Limiting factors: exploitation is local to the sandbox (not network-reachable), requires the deployment/authoring privilege level (PR:L), and depends on the CUSE-enabled host prerequisite (the AT:P attack requirement), so default hosts without CUSE are not exploitable.

This is a genuine sandbox-escape leading to host root code execution - the most severe outcome possible for a container-isolation product - but it is heavily gated. The source-provided CVSS 4.0 vector (8.8) is AV:L/AC:L/AT:P/PR:L/UI:N with full vulnerable-system impact (VC/VI/VA:H) AND full subsequent-system impact (SC/SI/SA:H), the latter correctly capturing the sandbox-to-host boundary crossing. The AT:P (attack requirement present) and PR:L signals are the key risk dampeners: exploitation requires the host to be running on a Linux platform with CUSE enabled AND the attacker to hold container-image deployment privileges - this is not remote, unauthenticated, or default-config exploitation. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so this reads as a high-impact-but-conditional issue rather than a mass-exploitation priority. The 'Information Disclosure' tag conflicts with the description, which clearly describes overwriting root udev helper memory to achieve code execution - this is RCE/sandbox-escape, not disclosure. Priority is high for organizations running gVisor in multi-tenant environments where untrusted parties can supply container images; low for everyone else.

An attacker with rights to deploy a container image into a gVisor-sandboxed environment builds an image containing a /dev/cuse character device node. From inside the sandbox they open the device, which on vulnerable versions is passed through to the host gofer instead of being emulated, letting them register a host CUSE device and abuse its unrestricted ioctl handling to overwrite the memory of the root udev helper and execute code as root on the host. No public POC is identified at time of analysis.