Linux IPv4 TCP use-after-free
Docker includes the Linux TCP kernel fix in 4.98.0. The underlying flaw was public October 15; this entry covers the Desktop remediation batch.
Docker Desktop 4.98 fixes a kernel TCP flaw and a WSL 2 socket-restriction bypass
Docker Desktop 4.98.0 fixes Linux IPv4 TCP use-after-free CVE-2026-98432 and CVE-2026-112917, a container bypass of AF_VSOCK restrictions on the WSL 2 backend. The latter also requires WSL 3.0.3 or later. The notes establish neither exploitation in the wild nor a host escape.
- Disclosed
- Nov 3, 2026
- Public disclosure date
- Severity
- Sharted
- 2 CVEs tracked here
- Splash zone
- Docker Desktop using affected VM networking; the AF_VSOCK issue concerns containers on the Windows WSL 2 backend
- Docker · WSL · isolation
- In the wild
- Unknown
- The vendor release notes do not report exploitation in the wild.
What happened
These flaws and this release are separate from the October Desktop batch; do not change that batch’s first fixed version from 4.97.0 to 4.98.0. L3 reflects kernel and isolation-boundary issues in a mainstream developer tool, not confirmed attacks.
AF_VSOCK supports host/VM communication. Docker states that a container can bypass a restriction, but gives no complete consequence, affected starting range, alternative mitigation or demonstrated host escape. The public CNA API for this CVE returned 404 during this check; its identifier and remediation dependency come from Docker’s original release notes, read directly. Do not import host-access consequences from the different CVE-2025-9074 incident. Updating only container images or distribution packages inside WSL does not establish Desktop/WSL remediation.
What’s in the bowl
CVE-2026-112917WSL 2 AF_VSOCK restriction bypass
A container on the WSL 2 backend can bypass communication restrictions; remediation requires Desktop 4.98.0 and WSL 3.0.3 or later. The notes do not supply a complete affected starting range.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Docker Desktop | 4.98.0 | |
| Windows Subsystem for Linux | 3.0.3 | Additional requirement for the WSL 2 backend fix |
Crime-scene timeline
Oct 15, 2026
Linux publishes the underlying TCP vulnerability record
Nov 3, 2026
Docker Desktop 4.98.0 ships both fixes
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Docker Desktop 4.98.0 release notesPrimaryNovember 3 fixes for both CVEs and the WSL 3.0.3 dependency.
- Linux CNA TCP vulnerability recordPrimaryUnderlying October 15 disclosure and IPv4 TCP option-lifetime race; this is not a newly disclosed Linux flaw.
- Microsoft WSL command documentationPrimaryDocuments wsl --update, wsl --version and the PowerShell/Command Prompt execution context.