What's Changed

• Fix MoveDistribution VHD ownership restore to reuse the resolved file handle (backport to release/2.7) by Ben Hillis (@benhillis) in #41147
• Backport security fixes to release/2.7 by Ben Hillis (@benhillis) in #41155

Full Changelog: 2.7.10...2.7.11

What's Changed

• Remove '.' from HCS suffix by Blue (@OneBlue) in #40946
• fix socket channel set exit events by Feng Wang (@chemwolf6922) in #40924
• Use strict detection of http line ending for docker response by yao-msft in #40932
• CLI: Fix hang with exec/run -i with self-exiting command and open stdin by David Bennett (@dkbennett) in #40921
• Don't append the build prefix when a line is being continued from a previous log entry by Blue (@OneBlue) in #40947
• Implement --stop-timeout in wslc create|run and support -1 (infinite) timeouts by Blue (@OneBlue) in #40919
• fix: use lowercased key when validating windowsterminal.profileTemplate by Syed Osama Ali Shah (@Osamaali313) in #40911
• Publish the WSLC nuget package on github releases by Blue (@OneBlue) in #40962
• Support arbitrary network driver options in wslc network create by beena352 in #40859
• Don't use an overlay for the gpu libraries if the inbox folder isn't present by Blue (@OneBlue) in #40969
• Fix Lost sub directory structure when mapping to a VHD volume by Kevin Vega (@kvega005) in #40857
• Add support for callback when loading images and display loaded images in wslc image load by Blue (@OneBlue) in #40960
• Fix https proxy not set when pac is used by Feng Wang (@chemwolf6922) in #40950
• Fix E_ACCESSDENIED during download if temp is hidden by Feng Wang (@chemwolf6922) in #40708
• Add configurable storage path for the default wslc session by Ben Hillis (@benhillis) in #40956
• Cap storage hw queue count to 4 by Feng Wang (@chemwolf6922) in #40975
• Fix potential use-after-free on the container deletion path by Blue (@OneBlue) in #41018
• Log an error when connect() fails in the NAT mode relay by Blue (@OneBlue) in #41033
• Mark routes via a link-local gateway as onlink to fix VPN /32 networking failures by Ben Hillis (@benhillis) in #41003
• Add wslc network connect and disconnect commands by beena352 in #41011
• Add support for container healthchecks by Blue (@OneBlue) in #41012
• Bump DeviceHost to 1.2.48-0 and to fix virtiofs O_APPEND ftruncate by Ben Hillis (@benhillis) in #41044
• Read /etc/locale.conf when configuring the distro locale by i4M1k0SU (@i4M1k0SU) in #40940
• Retry to delete WSL distribution shortcut for up to 10 seconds by Blue (@OneBlue) in #41046
• Add wslc container cp command for tar archive upload by Pooja Trivedi (@ptrivedi) in #40835

New Contributors

• Syed Osama Ali Shah (@Osamaali313) made their first contribution in #40911
• i4M1k0SU (@i4M1k0SU) made their first contribution in #40940

Full Changelog: 2.9.3...2.9.4

Release Notes

WSL Containers (WSLC) is now in Public Preview

We're excited to announce that WSL Containers (WSLC) is now available in public preview. WSLC brings native Linux container support to WSL, letting you build, run, and manage containers directly through the new wslc command line tool and a fully projected SDK (C++, C#/WinRT).

Highlights of what's available in this preview:

• Container lifecycle: create, run, start, kill, export, prune, and inspect containers, with per-container resource limits (--cpus, --memory, --ulimit), --shm-size, and configurable stop signals.
• Images: build (with --label support), pull, push, import, save (including multiple images in a single tar), inspect, list/prune with filters, and multi-image delete.
• Networking: create and manage networks, attach containers to multiple networks, network aliases, container:<name|id> network mode, custom network types, port publishing, and network prune.
• Volumes: create, list, prune, and remove volumes, with VHD-backed volumes and Uid/Gid/Fixed driver options.
• GPU support: GPU-enabled containers with CDI, mounted GPU executables and libraries accessible to non-root users.
• Sessions: named sessions with a default session created on demand, configurable storage location, and a default of 32 GB session storage.
• SDK: a C++ and C#/WinRT projection of the WSLC API, shipped as NuGet packages, plus a documented plugin API.
• Tooling: wslc logs with --timestamps, --since, --until, and -n; container stats; structured CLI output with color; MSBuild and CMake build integration; and group policy (ADMX) support for management.

Bug Fixes

• Fixed a stuck systemctl poweroff that could block VM termination by Feng Wang (@chemwolf6922) in #40866
• Fixed use-after-free issues in the virtiofs request worker thread by Blue (@OneBlue) in #40792 and in WSLC container exec-process teardown by yao-msft in #40822
• Fixed a potential init crash by catching exceptions in scope_exit reset by Blue (@OneBlue) in #40691
• Fixed shared pointer circular reference leaks by Feng Wang (@chemwolf6922) in #40480
• Fixed an IPv6 guest port reservation leak in Consomme (VirtioProxy) networking by Ben Hillis (@benhillis) in #40803
• Fixed mirrored mode port tracking for implicit binds from accept() calls by FetoiuCatalin in #40287 and denied guest binds to the host ephemeral port range in mirrored mode by FetoiuCatalin in #40597
• Avoided a distro zombie state when WSL init dies in systemd mode by Feng Wang (@chemwolf6922) in #40433
• Protected binfmt_misc from a cross-distro wipe at shutdown by Ben Hillis (@benhillis) in #40621
• Fixed incorrect wslpath translation of \\wsl.localhost when the current distro name is a subset of the target distro name by Blue (@OneBlue) in #40687
• Fixed CreateInstance failure when the Windows hosts file exceeds the message size cap by Ben Hillis (@benhillis) in #40718
• Fixed various initial tty sizing issues and added test coverage by Blue (@OneBlue) in #40722
• Improved virtiofs and VirtioProxy performance with a per-device SWIOTLB pool by Ben Hillis (@benhillis) in #40654

Fixes and Improvements

• Renamed the VirtioProxy networking mode to Consomme by Ben Hillis (@benhillis) in #40873
• Updated VM termination logic to enforce timeouts and avoid hanging when init is stuck by Blue (@OneBlue) in #40431
• Improved DNS tunneling reliability and VirtioNet tracing by Ben Hillis (@benhillis) in #40430 and Daman Mulye (@damanm24) in #40446
• Avoided std::terminate in the Plan9 FsUserContext destructor by Ben Hillis (@benhillis) in #40417
• Hardened VHD attach/restore by impersonating the mounting user, fixing a TOCTOU by Ben Hillis (@benhillis) in #40782
• Fixed MoveDistribution failing with E_ACCESSDENIED when setting the VHD owner under impersonation by Ben Hillis (@benhillis) in #40717
• Downgraded the system integrity-level impersonation token to high by Brian Perkins (@Brian-Perkins) in #40447

Security

• Updated the .NET runtime to 10.0.9 (CVE-2026-45491).
• Updated MSRDC to 1.2.7214 (CVE-2026-32157).

Full Changelog: 2.7.10...2.9.3

What's Changed

• Pass the mounting user's token on VHD restore (2.7 backport) by Ben Hillis (@benhillis) in #40907

Full Changelog: 2.7.9...2.7.10

• Update Microsoft.WSL.Kernel version to 6.18.33.2-2 to resolve a Windows under KVM and older AMD chipset boot regression

What's Changed

• Fix CreateInstance failure when Windows hosts file exceeds message size cap (2.7 backport) by Ben Hillis (@benhillis) in #40726
• Update kernel to 6.18.33.1-1 by Mitchell Levy (@chessturo) in #40728

Full Changelog: 2.7.7...2.7.8

What's Changed

• Update Microsoft.WSLg to version 1.0.73.2 by Ben Hillis (@benhillis) in #40585

Full Changelog: 2.7.6...2.7.7

What's Changed

• Update Microsoft.WSL.Kernel to 6.18.26.1 (#40161) by Mitchell Levy (@chessturo)
• Service: Best-effort grant of VMWP access to user-supplied VHDs (#40485) by Ben Hillis (@benhillis)

Full Changelog: 2.7.3...2.7.5

What's Changed

• Update Microsoft.WSL.DeviceHost package to 1.2.14-0 by Ben Hillis (@benhillis) in #40286
• Disable shared compilation when building wslsettings by Blue (@OneBlue) in #40289
• diagnostics: collect MSI verbose install logs in diagnostic bundle by Gordon Lam (@yeelam-gordon) in #40218
• Fix NuGet package path validation in nuget-stage pipeline by Ben Hillis (@benhillis) in #40293
• test: Add arm64 test distro support by Ben Hillis (@benhillis) in #14500
• test: remove duplicated DNS test coverage by Ben Hillis (@benhillis) in #14522
• Fix: Fail and warn the user when --uninstall is given parameters by Feng Wang (@chemwolf6922) in #14524
• virito net: revert to previous DNS behavior while we debug an issue with DNS over TCP by Ben Hillis (@benhillis) in #14532
• Update cgmanifest to match CMakeLists.txt by Blue (@OneBlue) in #14550
• socketshared: add maximum message size to avoid very large allocations by Ben Hillis (@benhillis) in #40050
• Fix: bind interrupted by seccomp signal race by Feng Wang (@chemwolf6922) in #14554
• Set Distro Env HOSTTYPE to aarch64 for ARM64 build by wangxin12 in #40048
• devicehost: stop re-signing and fix MSI installer failing to replace wsldevicehost.dll by Ben Hillis (@benhillis) in #40075
• Suppress MSI-initiated reboots during Store updates by Ben Hillis (@benhillis) in #40079
• build: add Source Link to embed GitHub source mappings in PDBs by Ben Hillis (@benhillis) in #40055
• Mask console-getty.service to prevent multi-distro failures (#13595) by Ben Hillis (@benhillis) in #14490
• Fix random "ERROR_FILE_NOT_FOUND" when unmounting with absolute path by Feng Wang (@chemwolf6922) in #40092
• Fixes to route mirroring by FetoiuCatalin in #40099
• Fix wrong variable checking by wangxin12 in #40185
• Bump Microsoft.NETCore.App.Runtime to 10.0.6 (CVE-2026-32178) by Ben Hillis (@benhillis) in #40207
• Fix VHD ownership after cross-volume move to prevent E_ACCESSDENIED by Ben Hillis (@benhillis) in #40159
• fix: use {} format specifier instead of %s in Linux LOG_ERROR path by Ben Hillis (@benhillis) in #40227
• Update MoveVhdOwnership test to WSL2 only by @Copilot in #40223
• fix: use ssize_t for readlinkat return value in p9file.cpp by Ben Hillis (@benhillis) in #40226
• cleanup: extract SkipSignal helper to deduplicate signal skip lists by Ben Hillis (@benhillis) in #40228
• fix: use correct GetAddrInfoTestEntry handler for get_addr_info test by Ben Hillis (@benhillis) in #40225
• fix: implement IDisposable on WslConfigService to dispose FileSystemWatcher by Ben Hillis (@benhillis) in #40249
• fix: add waitpid safety net after signalfd setup to prevent SIGCHLD race by Ben Hillis (@benhillis) in #40229
• Settings: Add pending changes tracking and apply confirmation dialog by Darshak Bhatti (@dabhattimsft) in #14425
• Add boot check for ipv6 disabled via registry in mirrored mode by FetoiuCatalin in #40235
• Fix broken WSLCorePort channel after receive timeout by Feng Wang (@chemwolf6922) in #14455
• Fix batch of minor bugs by Feng Wang (@chemwolf6922) in #40197
• Impersonate caller in ResizeDistribution VHD operations by Ben Hillis (@benhillis) in #40253
• Add BUFFER_FIELD macro for safe pretty-printing of flexible array members by Ben Hillis (@benhillis) in #40273
• Fix socket race condition in port tracking by Feng Wang (@chemwolf6922) in #40187
• Bound process name buffer in crash dump handler by Ben Hillis (@benhillis) in #40274
• Fix sizeof typo in MessageWriter::GetRelativeIndex by Ben Hillis (@benhillis) in #40276
• Add admin protection error message for shadow admin scenarios by Ben Hillis (@benhillis) in #40170

New Contributors

• wangxin12 made their first contribution in #40048
• FetoiuCatalin made their first contribution in #40099
• Gordon Lam (@yeelam-gordon) made their first contribution in #40218

Full Changelog: 2.7.1...2.7.3

What's Changed

Security

• Fix CVE-2026-26127: bump .NET runtime from 10.0.0 to 10.0.4 by Ben Hillis (@benhillis) in #14421

Bug Fixes

• virtiofs: fix elevated virtiofs access when VM is launched by an elevated user by Ben Hillis (@benhillis) in #13877
• Resolve issue with config file writing sections outside of their expected header by Ben Hillis (@benhillis) in #13898
• Resolve issue with buttons on notifications not working correctly by Ben Hillis (@benhillis) in #13921
• [GH 13837] Remove trailing slash from $XDG_RUNTIME_DIR by Ben Hillis (@benhillis) in #13929
• Fix issue with svccommio incorrectly resetting console state in the move operator by Ben Hillis (@benhillis) in #14083
• Fix excessive screen updates in progress indicators by @Copilot in #14206
• Fix 4 code bugs: substr off-by-one, HANDLE* cast, TOCTOU GetLastError, sun_path overflow by Ben Hillis (@benhillis) in #14297
• Fix wsl stuck when misconfigured cifs mount presents by Feng Wang (@chemwolf6922) in #14466
• Accessibility: After selecting from the navigation list, keyboard focus is now transferred to page content by ssparach in #14289

Features & Improvements

• virtiofs: add support for statx syscall by Ben Hillis (@benhillis) in #14087
• virtiofs: add support for mounting directories (not just full volumes) by Ben Hillis (@benhillis) in #14073
• virtio networking: add support for ipv6 by Ben Hillis (@benhillis) in #14350
• Enable DNS tunneling for VirtioProxy networking mode by Ben Hillis (@benhillis) in #14461
• DNS: switch to using 'search' instead of obsolete 'domain' by Ben Hillis (@benhillis) in #14133
• Track bind syscall when port is 0 by Daman Mulye (@damanm24) in #14333
• Add WindowsTerminal.enabled to the list of config keys for wsl-distribution.conf by Blue (@OneBlue) in #14021
• Disable the process creation cursor animation by default by Blue (@OneBlue) in #14293
• Improved VirtioProxy networking and VirtioFS posix compatibility by Ben Hillis (@benhillis) in #14198
• Updated enable virtualization error message by Craig Loewen (@craigloewen-msft) in #14110
• Mask NetworkManager-wait-online.service during boot by Dimitris Chatzis (@dhtzs) in #14272
• Add iptables to list of apps to install in WSL by Andre Muezerie (@andremueiot) in #14459

Developer Experience

• Enable VS 2026 solution generation and improve ARM64 developer experience by Ben Hillis (@benhillis) in #14283
• Refactor: Use TryParse in view models for safer numeric input parsing by Dimitris Chatzis (@dhtzs) in #14323

New Contributors

• Salman Chishti (@salmanmkc) made their first contribution in #13896
• Masanari Mizuno (@mznms) made their first contribution in #13950
• rfu-cn made their first contribution in #14022
• Andy Sterland (@andysterland) made their first contribution in #14160
• Dimitris Chatzis (@dhtzs) made their first contribution in #14272
• ssparach made their first contribution in #14289
• Daman Mulye (@damanm24) made their first contribution in #14333
• Andre Muezerie (@andremueiot) made their first contribution in #14459
• Feng Wang (@chemwolf6922) made their first contribution in #14466

Full Changelog: 2.7.0...2.7.1