Executive brief
A vulnerability in Docker Desktop could allow a local user to crash the underlying virtual machine. By creating deeply nested folders within a shared directory, a container can trigger a system failure (kernel panic). This results in a denial of service, impacting the availability of the Docker environment and any running applications.
Technical details
An uncontrolled recursion vulnerability (CWE-674) exists in the grpcfuse kernel module of Docker Desktop. The issue is triggered when a container creates deeply nested directories on a bind-mounted host folder, subsequently triggering a dentry invalidation event. This leads to a kernel panic within the Docker Desktop virtual machine. The attack requires local access with low privileges to create files within a bind mount. A fix is available in Docker Desktop version 4.76.0.
Affected products
- Docker Docker Desktop before 4.76.0
Timeline
- 2026-06-02: disclosed
- 2026-06-02: advisory
- 2026-06-02: patched: Fixed in Docker Desktop 4.76.0