Skip to content

Add CVE-2026-8936 security note to Desktop release notes #25243

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aevesdocker merged 1 commit into from
Jun 2, 2026
+4 −0
Merged

Add CVE-2026-8936 security note to Desktop release notes #25243

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions content/manuals/desktop/release-notes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,10 @@ For more frequently asked questions, see the [FAQs](/manuals/desktop/troubleshoo
- [Docker Scout CLI v1.21.0](https://github.com/docker/scout-cli/releases/tag/v1.21.0)
- `docker pass` v0.0.29

### Security

- Addressed [CVE-2026-8936](https://www.cve.org/CVERecord?id=CVE-2026-8936), a VM panic caused by unbounded recursion in the `grpcfuse` kernel module when a container created deeply nested directories on a bind-mounted host folder and triggered a `dentry` invalidation event.
Copy link
Copy Markdown

@docker-agent docker-agent Jun 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] Verify CVE identifier CVE-2026-8936 is correct before merge

The CVE number added here cannot be automatically confirmed as accurate. If the identifier is transposed or incorrect, users searching for this vulnerability notice will not find it, and affected users may not realize they are exposed.

Please verify the CVE number against NVD or the Docker Security Advisories before merging.

Copy link
Copy Markdown
Member Author

@mat007 mat007 Jun 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The CVE will go live around 1500 EST.

Copy link
Copy Markdown

@docker-agent docker-agent Jun 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the clarification! I'll note that the CVE is scheduled for publication at 1500 EST today. Since it's not live yet, that explains why it can't be verified against NVD currently.

Once the CVE goes live and this PR is ready to merge, the identifier should be verifiable. Appreciate the heads up on the timing.


### Bug fixes and enhancements

#### For all platforms
Expand Down