CVE-2026-8936

HighCVSS 8.2

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

Docker Desktop 4.76.0 fixes a VM panic caused by unbounded recursion in the grpcfuse kernel module when deeply nested directories are created on a bind-mounted host folder and a dentry invalidation event is triggered.

Risk Assessment

VM panic can lead to container disruption and data loss.

Recommendation

Update Docker Desktop to version 4.76.0 or later.

Other vulnerabilities in Docker Desktop

CVE-2026-6406High
The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop. When ECI is enabled, Docker socket mounts from containers are denied unless explicitly allowed. The --use-api-socket flag adds the mount via HostConfig.Mounts instead of HostConfig.Binds, and ECI enforcement only inspects Binds, allowing the mount to pass unchecked. This grants a container full access to the Docker Engine socket and, if the host user is logged into container registries, their authentication credentials.

Original NVD description (English source)

Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested directories on a bind-mounted host folder and triggered a dentry invalidation event. This issue has been fixed in Docker Desktop 4.76.0.