Source: golang-gvisor-gvisor Version: 0.0~20240729.0-7 X-Debbugs-CC: [email protected] Severity: grave Tags: security upstream
Hi, The following vulnerability was published for golang-gvisor-gvisor. CVE-2026-95702[0]: | Use-after-free vulnerability in VFS in Google gVisor prior to | release 20260831.0 on all platforms allows a local attacker with | standard container privileges to achieve code execution in the host | sentry process by double-freeing the backing MemoryFile from an in- | sandbox overlay filesystem. The sentry process remains confined by | host-level Linux seccomp and namespace boundaries. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-95702 https://www.cve.org/CVERecord?id=CVE-2026-95702 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
