Critical Docker Desktop Vulnerabilities Patched in Security Update
TL;DR
Docker released Docker Desktop version 4.98.0 on November 3, 2026. The release resolves two critical Docker Desktop vulnerabilities in container runtimes. The worst flaw lets unprivileged containers break out of isolation on Windows systems. Therefore, developers must update their Docker tools right away. They need to protect their workstations from harm.
[cve_glance_multi ids=”CVE-2026-112917, CVE-2026-98432″]
Why It Matters
Docker Desktop is the most popular container tool in the world. Sourced industry data shows wide adoption. Over 20 million developers use Docker Desktop on workstations. Millions of engineers run the tool on Windows. They use Windows Subsystem for Linux (WSL2) to host containers. Developer PCs often hold secret keys. They also store database passwords and source code. Because of this, container breakout bugs bring real risk to firm assets. Intruders can steal files. They can also plant malware across local networks.
Fortunately, Docker confirmed that no active exploitation in the wild has occurred. Furthermore, security teams have released no public exploit code for these bugs.
How the Attack Works
The security release fixes flaws in container filters and bundled Linux kernel code.
WSL2 AF_VSOCK Isolation Bypass
First, CVE-2026-112917 is a container isolation bypass in the Windows WSL2 backend. Researchers Oryam Halachmi and Tevel Halachmi found the bug. The advisory warns: “In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK.”
Docker uses default seccomp profiles to block access to the AF_VSOCK socket family. This socket family manages links between the host and the Linux guest VM. However, 64-bit WSL2 kernels support old 32-bit system calls. A container process runs a 32-bit socketcall to dodge 64-bit seccomp filters. This action gives the container direct access to the host AF_VSOCK bus. Consequently, the container can link to host-facing Windows services. An attacker can then read or change private Windows files. They can access any file owned by the logged-in user.
Linux Kernel IPv4 Use-After-Free
Second, CVE-2026-98432 is a critical use-after-free bug in the Linux kernel network stack. The flaw holds a 9.8 CVSS score. In the release notes, Docker confirmed that the build “Fixed CVE-2026-98432, a use-after-free in the Linux kernel’s IPv4 TCP handling.”
The bug triggers when the kernel processes concurrent IPv4 TCP requests. Specifically, the function tcp_v4_syn_recv_sock transfers ownership of socket options without copying them. Race bugs cause the kernel to free IP options while threads still use them. In turn, memory corruption can crash systems or run code as root.
Affected Versions
These Docker Desktop vulnerabilities affect Docker Desktop for Windows before version 4.98.0. Specifically, they impact setups using x86-64 WSL2. LinuxKit backends and macOS systems remain safe from the bypass.
Patch and Mitigation Steps
Users should update their software right away. Developers can check the official Docker Desktop 4.98.0 release notes for full details. However, updating Docker Desktop alone is not enough. The vendor warns: “The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later.” Therefore, Windows users must run wsl –update in PowerShell. This step updates WSL to version 3.0.3 or later. Finally, admins should reboot the system to apply all kernel fixes.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
