The bug is a double‑free and use‑after‑free condition in gVisor’s virtual filesystem layer that allows a process running inside a container to free a MemoryFile backing object twice and then trigger a use‑after‑free that ends up executing code inside the host’s sentry process. Because the sentry is confined only by host‑level seccomp and namespace isolation, a successful exploitation results in local code execution on the host that can be leveraged for further privilege escalation. This defect is classified as CWE‑415 and CWE‑416.

Google gVisor on all platforms is affected; any installation that has not been updated to release 20260831.0 or later is vulnerable. The issue appears in every component that exposes the VFS overlay filesystem to user containers.

The CVSS base score of 8.5 reflects a high severity for local privilege escalation. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local and requires a container to have standard privileges to manipulate the filesystem within the sandbox. An attacker would need to run a malicious program inside the container to trigger the double‑free, after which arbitrary code can execute in the host sentry process. Given the lack of an exploit probability metric, the focus should be on patching and hardening container boundaries.