{"id":"CVE-2026-95702","summary":"Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile","details":"Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.","modified":"2026-10-10T02:47:38.951274013Z","published":"2026-10-09T14:44:35.711Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95702.json","cna_assigner":"Google","cwe_ids":["CWE-415","CWE-416"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95702.json"},{"type":"PACKAGE","url":"https://github.com/google/gvisor"},{"type":"FIX","url":"https://github.com/google/gvisor/commit/25c75149bc0eeaa6a3a49b9bbe3473588b2af6df"},{"type":"FIX","url":"https://github.com/google/gvisor/commit/90bc4fc36fe442257a06ba15df00371561c183ed"},{"type":"FIX","url":"https://github.com/google/gvisor/commit/e4efb89c787ef15b09e68d561f1303380e1d5a77"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95702"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/google/gvisor","events":[{"introduced":"0"},{"fixed":"fd2f6b2674208086e324c2f739155eb7e1b48ff2"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"20260831.0"}],"source":"AFFECTED_FIELD"}}],"versions":["release-20260824.0","release-20260817.0","release-20260810.0","release-20260803.0","release-20260727.0","release-20260721.0","release-20260714.0","release-20260706.0","release-20260608.0","release-20260622.0","release-20260615.0","release-20260601.0","release-20260525.0","release-20260520.0","release-20260511.0","release-20260504.0","release-20260427.0","release-20260420.0","release-20260413.0","release-20260406.0","release-20260330.0","release-20260323.0","release-20260316.0","release-20260309.0","release-20260302.0","release-20260223.0","release-20260216.0","release-20260209.1","release-20260202.0","release-20260126.0","release-20260112.0","release-20260105.0","release-20251201.0","release-20251215.0","release-20251208.0","release-20251118.0","release-20251110.0","release-20251103.0","release-20251020.0","release-20250922.0","release-20250915.0","release-20251013.0","release-20251006.0","release-20250820.0","release-20250811.0","release-20250804.0","release-20250721.0","release-20250715.0","release-20250625.0","release-20250707.0","release-20250616.0","release-20250611.0","release-20250512.0","release-20250505.0","release-20250429.0","release-20250421.0","release-20250414.0","release-20250407.0","release-20250331.0","release-20250326.0","release-20250319.0","release-20250304.0","release-20250224.0","release-20250217.0","release-20250210.0","release-20250203.0","release-20250127.0","release-20250120.0","release-20250113.0","release-20250106.0","release-20241217.0","release-20241210.0","release-20241202.0","release-20241118.0","release-20241104.0","release-20241028.0","release-20241021.0","release-20241007.0","release-20240930.0","release-20240923.0","release-20240916.0","release-20240826.0","release-20240820.0","release-20240807.0","release-20240729.0","release-20240722.0","release-20240715.0","release-20240624.0","release-20240617.0","release-20240610.0","release-20240603.0","release-20240527.0","release-20240520.0","release-20240513.0","release-20240506.0","release-20240501.0","release-20240422.0","release-20240415.0","release-20240408.0","release-20240401.0","release-20240325.0","release-20240311.0","release-20240305.0","release-20240212.0","release-20240206.0","release-20240129.0","release-20240122.0","release-20240115.0","release-20240109.0","release-20231218.0","release-20231211.0","release-20231204.0","release-20231120.0","release-20231113.0","release-20231106.0","release-20231030.0","release-20231023.0","release-20231016.0","release-20231009.0","release-20231003.0","release-20230925.0","release-20230920.0","release-20230911.0","release-20230904.0","release-20230823.0","release-20230814.0","release-20230724.0","release-20230807.0","release-20230801.0","release-20230731.0","release-20230522.0","release-20230717.0","release-20230710.0","release-20230627.0","release-20230621.0","release-20230605.0","release-20230529.0","release-20230517.0","release-20230508.0","release-20230501.0","release-20230417.0","release-20230327.0","release-20230320.0","release-20230313.0","release-20230306.0","release-20230227.0","release-20230214.0","release-20230130.0","release-20230123.0","release-20230118.0","release-20230109.0","release-20230102.0","release-20221219.0","release-20221205.0","release-20221212.0","release-20221128.0","release-20221122.0","release-20221107.0","release-20221102.1","release-20221026.0","release-20221017.0","release-20221010.0","release-20221003.0","release-20220926.0","release-20220919.0","release-20220913.0","release-20220905.0","release-20220822.0","release-20220815.0","release-20220808.0","release-20220801.0","release-20220718.0","release-20220713.0","release-20220704.0","release-20220627.0","release-20220621.0","release-20220606.0","release-20220516.0","release-20220510.0","release-20220502.1","release-20220425.0","release-20220418.0","release-20220411.0","release-20220405.0","release-20220328.0","release-20220321.0","release-20220314.0","release-20220309.0","release-20220228.0","release-20220222.0","release-20220221.0","release-20220214.0","release-20220208.0","release-20220131.0","release-20220117.0","release-20220124.0","release-20220103.0","release-20211129.0","release-20211122.0","release-20211115.0","release-20211108.0","release-20211101.0","release-20211026.0","release-20211019.0","release-20211011.0","release-20211005.0","release-20210927.0","release-20210921.0","release-20210906.0","release-20210830.0","release-20210823.0","release-20210816.0","release-20210806.0","release-20210726.0","release-20210720.0","release-20210712.0","release-20210705.0","release-20210518.0","release-20210628.0","release-20210622.0","release-20210614.0","release-20210607.0","release-20210601.0","release-20210510.0","release-20210503.0","release-20210419.0","release-20210412.0","release-20210408.0","release-20210322.0","release-20210315.0","release-20210309.0","release-20210301.0","release-20210208.0","release-20210201.0","release-20210125.0","release-20210121.1","release-20210112.0","release-20201216.0","release-20201208.0","release-20201130.0","release-20201117.0","release-20201109.0","release-20201030.0","release-20201027.0","release-20200818.0","release-20201019.0","release-20201012.0","release-20201005.0","release-20200928.0","release-20200921.0","release-20200914.0","release-20200907.0","release-20200522.0","release-20200810.0","release-20200804.0","release-20200622.1","release-20200518.0","release-20200608.0","release-20200601.0","release-20200511.0","release-20200422.0","release-20200413.0","release-20200211.0","release-20200323.0","release-20200219.0","release-20200127.0","release-20200115.0","release-20191213.0","release-20191210.0","release-20191129.0","release-20191114.0","release-20191104.0","release-20190806.1","release-20190722.1","release-20190529.1","release-20190304.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95702.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}