golang-gvisor-gvisor - Debian Package Tracker

general

source: golang-gvisor-gvisor (main)
version: 0.0~20240729.0-7
maintainer: Debian Go Packaging Team (DMD)
uploaders: John Goerzen [DMD] – Shengjing Zhu [DMD]
arch: all amd64 arm64
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 0.0~20221219.0-2
old-bpo: 0.0~20240729.0-4~bpo12+2
stable: 0.0~20240729.0-4
testing: 0.0~20240729.0-7
unstable: 0.0~20240729.0-7

versioned links

0.0~20221219.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.0~20240729.0-4~bpo12+2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.0~20240729.0-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.0~20240729.0-7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

golang-gvisor-gvisor-dev
runsc (1 bugs: 0, 1, 0, 0)

action needed

Debci reports failed tests high

unstable: fail (log)
The tests ran in 0:03:17
Last run: 2026-09-25T06:41:31.000Z
Previous status: unknown

testing: fail (log)
The tests ran in 0:02:20
Last run: 2026-10-23T16:13:08.000Z
Previous status: unknown

stable: fail (log)
The tests ran in 0:03:28
Last run: 2026-10-19T06:45:00.000Z
Previous status: unknown

Created: 2025-06-01 Last update: 2026-10-29 11:03

Marked for autoremoval on 23 November: #1150508, #1150510 high

Version 0.0~20240729.0-7 of golang-gvisor-gvisor is marked for autoremoval from testing on Mon 23 Nov 2026. It is affected by #1150508, #1150510. The removal of golang-gvisor-gvisor will also cause the removal of (transitive) reverse dependencies: atlas-ecmwf, cockpit-podman, debcraft, distrobox, ectrans, eztrace, ggml, gloo-rocm, golang-github-containers-gvisor-tap-vsocks, golang-github-containers-toolbox, golang-github-crc-org-crc, groonga, groonga-normalizer-mysql, hipblas, hipcub, libjjml-java, llama.cpp, llama.vim, metview, nebula, nncp, pkg-rocm-tools, podman, rocblas, rocfft, rocprim, rocsolver, rocsparse, rocthrust, rust-repro-env, starpu, whisper.cpp, wireguard-go, yggdrasil. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-10-17 Last update: 2026-10-29 10:32

A new upstream version is available: 20261012.0 high

A new upstream version 20261012.0 is available, you should consider packaging it.

Created: 2025-11-27 Last update: 2026-10-29 09:21

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-95702: Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.
CVE-2026-96812: Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.

Created: 2026-10-09 Last update: 2026-10-13 15:30

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-95702: Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.
CVE-2026-96812: Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.

Created: 2026-10-09 Last update: 2026-10-13 15:30

6 security issues in bookworm high

There are 6 open security issues in bookworm.

4 important issues:

CVE-2024-10026: A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.
CVE-2024-10603: Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external attacker in some circumstances.
CVE-2026-95702: Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.
CVE-2026-96812: Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.

2 issues postponed or untriaged:

CVE-2023-7258: (needs triaging) A denial of service exists in Gvisor Sandbox where a bug in reference counting code in mount point tracking could lead to a panic, making it possible for an attacker running as root and with permission to mount volumes to kill the sandbox. We recommend upgrading past commit 6a112c60a257dadac59962e0bc9e9b5aee70b5b6
CVE-2025-2713: (needs triaging) Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-like permissions until the first fork.

Created: 2026-10-09 Last update: 2026-10-13 15:30

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit ef1eff30aa4d384628b42aba451fdb249f0e6d2c
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Wed Oct 28 11:33:06 2026 +0000

    debian: switch to standard Salsa CI pipeline

commit 0d2cc597dcc47556b7b9aff218b493267c00847c
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Wed Oct 28 11:31:54 2026 +0000

    debian/watch: Upgrade to format version 5 using GitHub template

https://salsa.debian.org/api/v4/projects/go-team%2Fpackages%2Fgolang-gvisor-gvisor API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-10-28 Last update: 2026-10-28 13:34

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2025-12-12 Last update: 2025-12-12 21:00

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-95702: (needs triaging) Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.
CVE-2026-96812: (needs triaging) Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a /dev/cuse character device node in a container image, opening the device passes through to the host, allowing the sandboxed attacker to register a host device and exploit CUSE unrestricted ioctl handling to overwrite root udev helper memory.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-10-09 Last update: 2026-10-13 15:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-03-31 15:01

news

[rss feed]

[2025-12-18] golang-gvisor-gvisor 0.0~20240729.0-7 MIGRATED to testing (Debian testing watch)
[2025-12-12] Accepted golang-gvisor-gvisor 0.0~20240729.0-7 (source) into unstable (Simon Josefsson)
[2025-12-11] Accepted golang-gvisor-gvisor 0.0~20240729.0-6 (source) into unstable (Simon Josefsson)
[2025-09-26] golang-gvisor-gvisor 0.0~20240729.0-5 MIGRATED to testing (Debian testing watch)
[2025-09-24] Accepted golang-gvisor-gvisor 0.0~20240729.0-5 (source) into unstable (John Goerzen)
[2024-09-08] Accepted golang-gvisor-gvisor 0.0~20240729.0-4~bpo12+2 (source) into stable-backports (John Goerzen)
[2024-09-02] Accepted golang-gvisor-gvisor 0.0~20240729.0-4~bpo12+1 (source) into stable-backports (John Goerzen)
[2024-08-12] golang-gvisor-gvisor 0.0~20240729.0-4 MIGRATED to testing (Debian testing watch)
[2024-08-09] Accepted golang-gvisor-gvisor 0.0~20240729.0-4 (source) into unstable (Shengjing Zhu)
[2024-08-08] Accepted golang-gvisor-gvisor 0.0~20240729.0-3 (source) into unstable (Shengjing Zhu)
[2024-08-07] Accepted golang-gvisor-gvisor 0.0~20240729.0-2 (source) into unstable (Shengjing Zhu)
[2024-08-06] Accepted golang-gvisor-gvisor 0.0~20240729.0-1 (source) into unstable (Shengjing Zhu)
[2024-05-28] golang-gvisor-gvisor 0.0~20230807.0-5 MIGRATED to testing (Debian testing watch)
[2024-05-26] Accepted golang-gvisor-gvisor 0.0~20230807.0-5 (source) into unstable (Anthony Fok)
[2023-09-05] Accepted golang-gvisor-gvisor 0.0~20230807.0-4~bpo12+1 (source all amd64) into stable-backports (Debian FTP Masters) (signed by: John Goerzen)
[2023-08-18] golang-gvisor-gvisor 0.0~20230807.0-4 MIGRATED to testing (Debian testing watch)
[2023-08-16] Accepted golang-gvisor-gvisor 0.0~20230807.0-4 (source) into unstable (Shengjing Zhu)
[2023-08-15] Accepted golang-gvisor-gvisor 0.0~20230807.0-3 (source) into unstable (Shengjing Zhu)
[2023-08-11] Accepted golang-gvisor-gvisor 0.0~20230807.0-2 (source) into unstable (Shengjing Zhu)
[2023-08-11] Accepted golang-gvisor-gvisor 0.0~20230807.0-1 (source) into unstable (Shengjing Zhu)
[2023-01-07] Accepted golang-gvisor-gvisor 0.0~20221219.0-2~bpo11+1 (source) into bullseye-backports (John Goerzen)
[2023-01-07] golang-gvisor-gvisor 0.0~20221219.0-2 MIGRATED to testing (Debian testing watch)
[2023-01-04] Accepted golang-gvisor-gvisor 0.0~20221219.0-2 (source) into unstable (Shengjing Zhu)
[2023-01-01] Accepted golang-gvisor-gvisor 0.0~20221219.0-1 (source) into unstable (Shengjing Zhu)
[2022-11-22] golang-gvisor-gvisor 0.0~20220905.0-2 MIGRATED to testing (Debian testing watch)
[2022-11-17] Accepted golang-gvisor-gvisor 0.0~20220905.0-2 (source) into unstable (Shengjing Zhu)
[2022-11-16] Accepted golang-gvisor-gvisor 0.0~20220905.0-1 (source all amd64) into unstable (Debian FTP Masters) (signed by: Shengjing Zhu)

bugs [bug history graph]

all: 3
RC: 2
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.0~20240729.0-7
1 bug