Use-After-Free Vulnerability in Google gVisor Allowing Code Execution

CVE-2026-95702

What is CVE-2026-95702?

The vulnerability in Google gVisor stems from a use-after-free scenario within the Virtual File System (VFS). This issue permits a local attacker, granted standard container privileges, to execute arbitrary code in the host's sentry process. This occurs due to a double-free operation on the MemoryFile associated with an in-sandbox overlay filesystem. Despite the exploit potential, the execution remains confined within the security boundaries established by Linux seccomp and namespace protections on the host.

References