CVE-2026-95702: 
Podman vulnerability analysis and mitigation

CVE-2026-95702 is a use-after-free (UAF) vulnerability in the Virtual Filesystem (VFS) layer of Google gVisor that allows a local attacker with standard container privileges to achieve arbitrary code execution in the host sentry process. The flaw is triggered by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem, classified under CWE-415 (Double Free) and CWE-416 (Use After Free). All platforms running gVisor prior to release 20260831.0 are affected. It carries a CVSS v3.1 score of 7.8 (High) and a CVSS v4.0 score of 8.5 (High) (Github Advisory, Red Hat Bugzilla). The vulnerability was published on October 9, 2026, with patches available in gVisor release 20260831.0 and later (Github Advisory).

The root cause lies in improper reference counting within gVisor's VFS mount management code (CWE-415/CWE-416/CWE-825). Specifically, when a mount is partially unmounted (e.g., via MNT_DETACH/lazy umount), the code incorrectly drops references on both the mount parent and the mount point dentry, leading to a double-free of the backing MemoryFile associated with an in-sandbox overlay filesystem. Three commits address distinct facets of the bug: e4efb89 fixes partially-umounted mount refcounting so only the parent reference is dropped (not the mount point), 25c7514 adds a panic guard in the overlayfs IncRef() path to catch non-positive refcount increments, and 90bc4fc removes nsfs/cgroupfs exemptions from umount checks during bind mounting to prevent exploitation via detached mounts (gVisor commit e4efb89, gVisor commit 25c7514, gVisor commit 90bc4fc). Exploitation requires only standard container-level (low) privileges and no user interaction, making it accessible to any process running inside a gVisor sandbox.

Successful exploitation allows a local attacker inside a gVisor sandbox to execute arbitrary code within the host sentry process — the privileged Go process that mediates all system calls on behalf of sandboxed workloads. This results in full compromise of confidentiality, integrity, and availability of the sentry process and any data it handles (Github Advisory). Critically, the sentry process remains confined by host-level Linux seccomp filters and namespace boundaries, which limits but does not eliminate the risk of further host escape; an attacker who controls the sentry could potentially leverage its elevated position to access secrets, manipulate container workloads, or attempt further privilege escalation within those host-level constraints (Red Hat Bugzilla).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Github Advisory). The EPSS score is approximately 0.084% (0th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The NVD SSVC assessment classifies exploitation as "none" at this time, though the low attack complexity and low privilege requirement make it a credible target for future weaponization in containerized environments (Github Advisory).

1. Gain container access: Obtain standard (low-privilege) user access within a gVisor-sandboxed container running a vulnerable version prior to release 20260831.0.
2. Set up overlay filesystem: Mount an in-sandbox overlay filesystem, which involves creating upper, lower, and work directories and mounting them with overlayfs.
3. Trigger lazy unmount: Perform a lazy unmount (umount2(..., MNT_DETACH)) on a mount that has a locked child mount, causing the mount to be marked as umounted while still connected to its parent in the mount tree.
4. Exploit refcount bug: Manipulate the mount tree (e.g., via bind mounting a detached nsfs/cgroupfs mount, or by triggering forgetDeadMountpoint) to cause the VFS layer to double-decrement the reference count on the backing MemoryFile, resulting in a use-after-free condition.
5. Achieve code execution: Exploit the freed memory region in the sentry process's heap to redirect execution flow, achieving arbitrary code execution within the host sentry process (gVisor commit e4efb89, gVisor commit 90bc4fc).

• Logs: Unexpected panics or crashes in the gVisor sentry process logs (e.g., runsc logs) referencing overlayfs refcount errors or messages like Incrementing negative count on overlay.dentry; sentry process restarts without clear cause.
• Process: Unusual child processes or goroutines spawned by the gVisor sentry (runsc) process; unexpected system calls originating from the sentry that fall outside its normal seccomp-filtered profile.
• File System: Unexpected overlay filesystem mounts or unmounts within sandboxed containers; creation of temporary directories consistent with overlay upper/work layer setup followed by rapid unmount sequences.
• Network: Anomalous outbound connections from the sentry process or sandboxed workloads to external hosts, potentially indicating post-exploitation activity.

The primary remediation is to upgrade Google gVisor to release 20260831.0 or later, which includes three patches addressing the refcounting flaws in VFS mount management and overlayfs (Github Advisory). No official configuration-based workaround has been published. As a defense-in-depth measure, operators should restrict container privileges where possible, limit the ability of sandboxed workloads to perform mount/unmount operations, and monitor for anomalous sentry process behavior. Organizations using gVisor in Kubernetes environments (e.g., via GKE Sandbox) should verify their node image versions and apply available updates promptly (Red Hat Bugzilla).

Red Hat opened a high-severity bug tracking entry (Bugzilla #2548662) for this CVE, indicating relevance to their product ecosystem (Red Hat Bugzilla). The vulnerability was noted on VulDB and discussed briefly on Infosec.Exchange social media, with general acknowledgment of the container escape risk context. No major vendor statements beyond Google's patch commits or significant researcher blog posts have been identified at this time.