CVE-2026-96812 in gVisor
Summary
by MITRE • 09/25/2026
Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified as Improper Exposure of Resource to Wrong Sphere within Google gVisor represents a critical failure in container isolation mechanisms on Linux platforms utilizing Character Device Userspace (CUSE). This flaw specifically affects the host file helper, known as gofer, prior commit 573a9e73cf844f. The core issue stems from an inadequate validation of device node permissions and scope during the initialization phase when a container attempts to access specific character devices. When CUSE is enabled, which allows userspace programs to implement custom kernel drivers via ioctl calls, gVisor fails to properly restrict the context in which these devices operate. This misconfiguration creates a bridge between the untrusted container environment and the privileged host system, bypassing the intended sandbox boundaries that are fundamental to virtualization security models.
The technical mechanism of exploitation relies on the attacker's ability to include a /dev/cuse character device node within their deployed container image. Under normal circumstances, such devices should be strictly controlled or blocked by the runtime environment to prevent direct interaction with host-level hardware abstractions. However, due to the improper exposure flaw, opening this device file inside the container does not remain confined. Instead, the operation passes through directly to the host system's kernel interface. This allows a sandboxed attacker, who typically possesses only standard user privileges within the container but has image deployment rights, to register a new host device. Once registered, the attacker gains access to unrestricted ioctl handling capabilities associated with CUSE devices. These ioctls are designed for legitimate driver communication but lack sufficient sanitization or boundary checks in this specific version of gVisor, allowing arbitrary memory operations from within the container context.
The operational impact of this vulnerability is severe, leading directly to root code execution on the host system. By leveraging the unrestricted ioctl handling, an attacker can craft malicious commands that manipulate kernel structures and user-space helper processes running with elevated privileges. Specifically, the exploit targets the udev helper process, which manages device events in Linux systems. Through precise memory corruption techniques facilitated by the CUSE interface, the attacker overwrites critical data within the root-level udev helper memory space. This overwrite allows for arbitrary code execution under the context of the host's most privileged user account. Consequently, the container escape is not merely a privilege escalation but a complete compromise of the underlying infrastructure, granting full control over the physical or virtual machine hosting the containers.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-787 Out-of-bounds Write in memory manipulation contexts. It also maps to MITRE ATT&CK techniques related to Container Escape (T1611) and Privilege Escalation via Host Process Injection or Memory Manipulation, reflecting the lateral movement from a confined workload to the host control plane. The attack vector is Local with High Complexity requirements regarding payload construction but results in Critical impact due to full system compromise. Security practitioners must recognize that even sandboxed environments relying on virtualization technologies like gVisor are susceptible to deep kernel-level exploits if device passthrough rules and ioctl sanitizations are not rigorously enforced.
Mitigation strategies focus primarily on immediate patching and configuration hardening. Organizations running Google gVisor prior to the specified commit 573a9e73cf844f must upgrade to a patched version where the gofer component correctly validates device access scopes and restricts CUSE interactions to trusted contexts only. In environments where upgrading is not immediately feasible, administrators should disable CUSE support entirely if it is not strictly required for application functionality. Additionally, implementing strict seccomp profiles that block specific ioctl commands associated with untrusted character devices can provide a layer of defense-in-depth. Regular auditing of container images for the presence of sensitive device nodes like /dev/cuse and enforcing policies that prevent their inclusion in deployment artifacts are essential preventive measures to reduce the attack surface against this class of virtualization escape vulnerabilities.