CVE-2026-8936 HIGH

CVE-2026-8936: Unbounded recursion in grpcfuse kernel module allows container to crash Docker Desktop VM

Vendor Docker
Product Docker Desktop
Weakness CWE-674
Published June 2, 2026
Last update June 3, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/R:U

What the vulnerability does

01Description

Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested directories on a bind-mounted host folder and triggered a dentry invalidation event. This issue has been fixed in Docker Desktop 4.76.0.

Key dates

02Disclosure timeline

June 2, 2026 CVE published
June 3, 2026 Record updated