WSL2 AF_VSOCK isolation bypass via 32-bit socketcall
Not on CISA's list of exploited flaws, and not in the news we track.
9.2of 10, critical
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-112917. Nothing runs until you send it.
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.