Skip to content

4.72 RN addition #24997

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aevesdocker merged 1 commit into from
May 7, 2026
+1 −0
Merged

4.72 RN addition #24997

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions content/manuals/desktop/release-notes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ For more frequently asked questions, see the [FAQs](/manuals/desktop/troubleshoo
### Security

- The Extensions settings page now includes a security notice that extensions run with host-level privileges and are not audited by Docker.
- [Fixed CVE-2026-31431 ("copy.fail")](https://xint.io/blog/copy-fail-linux-distributions) by backporting an upstream Linux kernel patch that prevents an unprivileged container user from gaining root inside the container via a controlled write into the host VM page cache.
Copy link
Copy Markdown

@docker-agent docker-agent May 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] CVE identifier year appears incorrect: CVE-2026-31431 should likely be CVE-2025-31431

The CVE identifier uses the year 2026, which is a future year. CVEs are assigned in the year they are reported, so CVE-2026-31431 would be anachronistic. This is almost certainly a typo — the correct identifier is likely CVE-2025-31431 (or possibly CVE-2024-31431).

An incorrect CVE number prevents users from looking up this vulnerability in NVD or MITRE and could mislead security teams researching the fix.


### Bug fixes and enhancements

Expand Down