Unbounded recursion in the grpcfuse kernel module causes a kernel panic that crashes the Docker Desktop virtual machine. The flaw is an example of uncontrolled recursion (CWE-674) and results in loss of service availability. No direct remote code execution or data exfiltration is possible; the primary harm is a crash of the host VM, potentially impacting all containers running in Docker Desktop.

Docker Desktop installations of Docker on any platform earlier than version 4.76.0 are vulnerable. The issue was fixed in Docker Desktop 4.76.0, so updates to that release or later remove the risk.

The CVSS score of 8.2 indicates a high severity, and the EPSS score is unavailable, while the vulnerability is not listed in the CISA KEV catalog. The least‑privileged attacker would need to run a container that creates deeply nested directories on a bind‐mounted host folder to trigger the recursion and cause a VM panic. If an attacker can orchestrate such a container, the local VM will crash, denying service to all running containers.