Add CVE-2026-8936 security note to Desktop release notes#25243
Conversation
✅ Deploy Preview for docsdocker ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
github-actions
Bot
added
the
area/desktop
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
One LIKELY finding requires human verification before merge.
|
|
||
| ### Security | ||
|
|
||
| - Addressed [CVE-2026-8936](https://www.cve.org/CVERecord?id=CVE-2026-8936), a VM panic caused by unbounded recursion in the `grpcfuse` kernel module when a container created deeply nested directories on a bind-mounted host folder and triggered a `dentry` invalidation event. |
There was a problem hiding this comment.
[HIGH] Verify CVE identifier CVE-2026-8936 is correct before merge
The CVE number added here cannot be automatically confirmed as accurate. If the identifier is transposed or incorrect, users searching for this vulnerability notice will not find it, and affected users may not realize they are exposed.
Please verify the CVE number against NVD or the Docker Security Advisories before merging.
There was a problem hiding this comment.
The CVE will go live around 1500 EST.
There was a problem hiding this comment.
Thanks for the clarification! I'll note that the CVE is scheduled for publication at 1500 EST today. Since it's not live yet, that explains why it can't be verified against NVD currently.
Once the CVE goes live and this PR is ready to merge, the identifier should be verifiable. Appreciate the heads up on the timing.
3 participants
Adds a Security section to the Docker Desktop release notes documenting CVE-2026-8936, a VM panic caused by unbounded recursion in the
grpcfusekernel module.