Hi,

The following vulnerability was published for golang-gvisor-gvisor.

i'm not completely sure if this affects our old version, but still
filling it as RC level.

Side question: it is still sensible to keep gvisor in Debian at this
old version, should it be updated or removed?

CVE-2026-96812[0]:
| Improper Exposure of Resource to Wrong Sphere in the host file
| helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on
| Linux platforms with CUSE enabled allows a local attacker with
| container image deployment privileges to achieve root code execution
| on the host system. By including a /dev/cuse character device node
| in a container image, opening the device passes through to the host,
| allowing the sandboxed attacker to register a host device and
| exploit CUSE unrestricted ioctl handling to overwrite root udev
| helper memory.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-96812
https://www.cve.org/CVERecord?id=CVE-2026-96812

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore