TCP fixes extend from Docker Desktop and GKE to XenServer hosts and appliances

These flaws and this release are separate from the October Desktop batch; do not change that batch’s first fixed version from 4.97.0 to 4.98.0. L3 reflects kernel and isolation-boundary issues in a mainstream developer tool, not confirmed attacks.

AF_VSOCK supports host/VM communication. Docker states that a container can bypass a restriction, but gives no complete consequence, affected starting range, alternative mitigation or demonstrated host escape. The public CNA API for this CVE returned 404 during this check; its identifier and remediation dependency come from Docker’s original release notes, read directly. Do not import host-access consequences from the different CVE-2025-9074 incident. Updating only container images or distribution packages inside WSL does not establish Desktop/WSL remediation.

November 4 GKE deployment update: Google’s GCP-2026-078 covers the same Linux TCP CVE on GKE Standard and Autopilot. Google describes kernel panic or container escape with root execution on the node. A container process needs no special capabilities; the network path instead requires access to a TCP listener on nodes, Pods or the control plane’s IP-based endpoint and IPv4-option packets. Trusted-source access restrictions address the network path, not the local container path.

Google supplies five Container-Optimized OS thresholds above and requires upgrading both control plane and nodes. GKE 1.37 and Ubuntu node-image patches are still in progress. These deployment-specific consequences do not prove a host escape through Desktop, do not change the WSL bypass’s documented scope and do not establish the cause of the separate Northflank incident. No exploitation claim is added. The existing L3 rating is retained for mainstream kernel/isolation remediation without verified attacks.

November 5 XenServer follow-up: Citrix’s November 3 CTX697256 covers the already-listed TCP CVE on XenServer 8.4 and XenServer 9, plus Workload Balancing before 2026.1.1 and Conversion Manager before 2026.2.0. An unauthenticated attacker needs access to the management network for the described host/appliance compromise; the vendor does not describe this as arbitrary internet access. Install the latest cumulative updates in the selected host channel as well as the appliance releases. The appliance thresholds alone do not patch the hypervisor, and the bulletin supplies no single fixed host build.

The same vendor batch also lists CVE-2026-102703, for which a privileged guest user may compromise the host. Upstream XSA-523 describes grant-copy validation errors that let a malicious guest read/write other domains’ memory, including Dom0, and gives no known mitigation. XSA-523 also discusses CVE-2026-102704; Citrix’s cited bulletin does not list that second identifier, so its XenServer applicability is not inferred here.

Six further identifiers—CVE-2026-97631, CVE-2026-45447, CVE-2024-38797, CVE-2024-38796, CVE-2022-36764 and CVE-2022-36763—are grouped as compromise of a VM during initial PXE network boot by an unauthenticated same-network attacker, or bypass of that guest’s Secure Boot policy by its administrator. Those are separate prerequisites and effects, not eight unauthenticated host-compromise flaws. No confirmed XenServer exploitation or victim count is established by these sources. The existing L3 rating, Desktop/WSL requirements, five GKE COS thresholds and pending GKE 1.37/Ubuntu fixes remain applicable; XenServer remediation is not evidence of a Docker escape or the cause of Northflank’s breach.