# Rancher Desktop v1.22.3 — Rancher Desktop 1.22.3

- Product: Rancher Desktop (https://whatsnew.fyi/product/rancher-desktop)
- Vendor: SUSE
- Date: 2026-05-13
- Version: v1.22.3
- Original notes: https://github.com/rancher-sandbox/rancher-desktop/releases/tag/v1.22.3
- Permalink: https://whatsnew.fyi/product/rancher-desktop/releases/v1.22.3
- Labels: Platforms: Desktop

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Remove Linux kernel modules esp4, esp6, rxrpc, and algif_aead to mitigate container escape vulnerabilities CVE-2026-31431, CVE-2026-43284, and CVE-2026-43500
- **changed** — Bundle Alpine VM image with newer kernel containing additional upstream security patches
- **fixed** — Restore correct bind-mount behavior for docker run --mount type=bind flag on Windows
- **fixed** — Fix data volume mount failure on macOS that caused data to be stored in RAM disk instead of persisting to disk
- **changed** — Upgrade trivy from 0.68.2 to 0.70.0
- **added** — Allow users to select moby storage driver between classic and containerd-snapshotter via rdctl

This is the 1.22.3 release of Rancher Desktop, an open source desktop application to bring Kubernetes and container management to macOS, Windows, and Linux.

##### Installers

* [Windows](https://github.com/rancher-sandbox/rancher-desktop/releases/download/v1.22.3/Rancher.Desktop.Setup.1.22.3.msi)
* [macOS x86_64](https://github.com/rancher-sandbox/rancher-desktop/releases/download/v1.22.3/Rancher.Desktop-1.22.3.x86_64.dmg)
* [macOS aarch64](https://github.com/rancher-sandbox/rancher-desktop/releases/download/v1.22.3/Rancher.Desktop-1.22.3.aarch64.dmg)
* [Linux install notes](https://docs.rancherdesktop.io/1.22/getting-started/installation#linux)

##### Release Notes for 1.22.3

Rancher Desktop 1.22.3 is a security-focused patch release. We strongly recommend upgrading.

###### Security Fixes

> [!IMPORTANT]
> **macOS and Linux**: additional steps required after upgrading.
A bug in the ISO version comparison means an in-place upgrade from any earlier 1.22.x release will keep booting the previous kernel, leaving the modules listed below in place. Choose one of these to apply the container-escape mitigation:
> * Manual kernel upgrade (preserves your data): follow the steps in [#10288](https://github.com/rancher-sandbox/rancher-desktop/discussions/10288).
> * Factory reset: run Troubleshooting → Factory Reset after upgrading. This removes all containers, images, and Kubernetes state — back up anything you need to keep first.
>
> Windows is not affected: the mitigation ships in the application binary and applies on the next start.

###### Container escape mitigation (CVE-2026-31431, CVE-2026-43284, CVE-2026-43500)

Three recent Linux kernel exploits — copy.fail (CVE-2026-31431) and the two dirtyfrag variants (CVE-2026-43284, CVE-2026-43500) — let unprivileged processes gain a page-cache write primitive and tamper with files outside their normal reach. Inside Rancher Desktop, that means an attacker with code execution in any container could escape that scope and modify the rest of the VM.

Each exploit needs a specific Linux kernel module loaded. Rancher Desktop now removes those modules, so the exploits have nothing to hook into.

Modules removed:

| Module | Used for | CVE it enables |
| --- | --- | --- |
| `esp4` / `esp6` | IPsec ESP (site-to-site VPN gateways, e.g. strongSwan, libreswan) | CVE-2026-43284 (dirtyfrag, XFRM ESP) |
| `rxrpc` | RxRPC protocol, used almost exclusively by AFS / kAFS (Andrew File System) | CVE-2026-43500 (dirtyfrag, AF_RXRPC) |
| `algif_aead` | Kernel AEAD crypto via AF_ALG sockets (offload to hardware accelerators) | CVE-2026-31431 (copy.fail) |

**What this means for you:** unless you run an IPsec VPN endpoint or an AFS client, the removal is invisible to you.

**On macOS and Linux**, the rebuilt Alpine VM image omits the modules. ([#10220](https://github.com/rancher-sandbox/rancher-desktop/pull/10220), [#10248](https://github.com/rancher-sandbox/rancher-desktop/pull/10248))

**On Windows**, WSL2 provides kernel modules through a single overlay shared by every WSL distro running on the host, which means:

- When Rancher Desktop starts, it removes these modules for **all** running WSL distros, not just its own. Other distros will lose IPsec ESP, AFS, and AF_ALG until WSL itself restarts.
- When WSL restarts (e.g. `wsl --shutdown` followed by launching any distro), the upstream WSL kernel restores the modules.
- The next time Rancher Desktop starts, it removes them again.

This is an "apply-on-start" / "forget-on-stop" lifecycle: Rancher Desktop never persists changes to your WSL installation. ([#10247](https://github.com/rancher-sandbox/rancher-desktop/pull/10247))

The bundled Alpine VM image also picks up a newer kernel containing additional upstream security patches.

###### Bug Fixes

###### Bind mounts via the Docker `--mount` flag on Windows

In Rancher Desktop 1.22.2, `docker run --mount type=bind,...` on Windows could mount the wrong direc

_[Truncated at 4000 characters — full notes: https://github.com/rancher-sandbox/rancher-desktop/releases/tag/v1.22.3]_