CVE-2026-8936: Unbounded recursion in grpcfuse kernel module allows container to crash Docker Desktop VM

Synopsis

This is a denial-of-service vulnerability caused by unbounded recursion in the grpcfuse kernel module included in Docker Desktop. It is reachable locally by a process running inside a container, requires only a low-privilege account, and does not need any network access or victim interaction. Successful exploitation crashes the Docker Desktop VM, taking down all running containers on the host. A patched-image rebuild at Docker Desktop 4.76.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to trigger the vulnerability.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative or root-level credentials to initiate the exploit.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the crash entirely through their own process actions inside a container.

• Attack complexityDetail

  The exploit is reliable and condition-free; creating deeply nested directories on a bind-mounted host folder consistently triggers the dentry invalidation path that causes the recursion.

Blast Radius

• Crashes the Docker Desktop VM, immediately terminating all containers running on that host.
• Causes unrecoverable loss of any in-memory or in-flight work across every container on the affected VM.
• Disrupts any CI/CD pipeline or local development workflow dependent on the Docker Desktop instance until the VM is manually restarted.
• No confidentiality or data-integrity impact; the attacker cannot read or modify files through this vulnerability.