CVE-2026-96812 Google CVE debrief

Who should care

Linux platform administrators and security teams responsible for container deployments using gVisor with CUSE enabled should assess exposure and apply patches prior to commit 573a9e73cf844f. They should also verify gVisor versions, restrict container image deployment privileges, and monitor container deployments for suspicious activity.

Why it matters

CVE-2026-96812 allows local attackers with container image deployment privileges to achieve root code execution on host systems running Google gVisor with CUSE enabled. Linux platform administrators and security teams should assess exposure, verify and apply patches, and monitor container deployments for suspicious activity.

• Local privilege escalation to root code execution on host systems.
• Potential for container escape and host compromise.
• Need for immediate patching and verification of gVisor versions.
• Limited information available on affected versions and exploitation.

Technical summary

The vulnerability in Google gVisor allows local attackers with container image deployment privileges to achieve root code execution on the host system by including a /dev/cuse character device node in a container image, which passes through to the host and allows the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory. This vulnerability is a result of improper exposure of resource to wrong sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled.

Defensive priority

High priority for Linux platform container deployments using gVisor with CUSE enabled; verify and apply patches immediately.

Recommended defensive actions

• Verify gVisor versions and apply patches prior to commit 573a9e73cf844f.
• Restrict container image deployment privileges.
• Monitor container deployments for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Google gVisor. Limited information is available on affected versions and exploitation. The vulnerability allows local attackers with container image deployment privileges to achieve root code execution on the host system. Verify gVisor versions and apply patches prior to commit 573a9e73cf844f. Monitor container deployments for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.