CVE-2026-110450: Nix and Lix Privilege Escalation Vulnerability

CVE-2026-110450 Overview

CVE-2026-110450 is a local privilege escalation vulnerability affecting the Nix and Lix package managers. The flaw exists in the repair operation, which destroys and replaces a store path before performing content verification. A local attacker can abuse this ordering issue to substitute attacker-controlled content into a trusted store path, leading to privilege escalation on the host. The vulnerability is tracked as [CWE-696] (Incorrect Behavior Order) and affects Nix versions before 2.35.3 and Lix versions before 2.95.4.

Critical Impact
A local user can replace trusted store paths with malicious content during a repair operation, achieving privilege escalation on affected hosts.

Affected Products

Nix package manager versions prior to 2.35.3
Lix package manager versions prior to 2.95.4
NixOS and Lix-based Linux distributions using vulnerable package manager builds

Discovery Timeline

2026-10-14 - CVE-2026-110450 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110450

Vulnerability Analysis

Nix and Lix maintain an immutable /nix/store where each path is addressed by a cryptographic hash of its contents. Store integrity depends on the invariant that content inside a store path matches its hash. The repair operation violates this invariant by removing and replacing a store path before verifying the new content against the expected hash. During the window between replacement and verification, the store path contains unverified data that the daemon still treats as trusted. A local attacker who can influence the content delivered during repair can poison a store path that privileged processes later execute, resulting in privilege escalation.

Root Cause

The root cause is an incorrect ordering of security-critical operations, categorized as [CWE-696]. The repair routine performs destructive state changes before validating replacement content. Content verification must occur before any trusted path is overwritten, otherwise the store's hash-addressed integrity model does not hold.

Attack Vector

Exploitation requires local access to a system running a vulnerable Nix or Lix daemon. The attacker triggers a repair operation on a targeted store path and supplies substitute content that is written to the store before the hash check runs. Once the poisoned path is referenced by a privileged build, system service, or setuid wrapper, the attacker's code executes with elevated privileges. See the NixOS Security Advisory October 2026 for upstream technical details.

Detection Methods for CVE-2026-110450

Indicators of Compromise

Unexpected invocations of nix-store --repair-path or nix store repair from non-administrative users
Store paths whose on-disk content hash does not match the hash encoded in the path name
Daemon log entries showing repair operations followed by hash mismatches or verification warnings

Detection Strategies

Audit the nix-daemon process for repair-related IPC calls originating from unprivileged accounts
Run nix store verify --all on a scheduled cadence and alert on any paths flagged as invalid or tampered
Correlate file-system modification events under /nix/store with the identity of the invoking user and the daemon's operation log

Monitoring Recommendations

Forward nix-daemon logs to a centralized logging platform and alert on repair operations outside maintenance windows
Monitor privileged process executions whose binary resolves to a recently repaired store path
Baseline normal repair activity per host so that anomalous volume or timing of repairs raises an alert

How to Mitigate CVE-2026-110450

Immediate Actions Required

Upgrade Nix to version 2.35.3 or later and Lix to version 2.95.4 or later on every affected host
Restart the nix-daemon service after upgrading so the patched binary handles subsequent repair operations
Review recent repair operations and run nix store verify --all to detect any store paths that may already be poisoned

Patch Information

Upstream fixes are available in Nix 2.35.3 and Lix 2.95.4. Both releases change the repair operation so that content is verified against the expected hash before the existing store path is replaced. Refer to the NixOS Security Advisory October 2026 for the full list of fixed branches and backport details.

Workarounds

Restrict access to the nix-daemon Unix socket so that only trusted administrative accounts can trigger repair operations
Disable or avoid invoking repair operations on multi-user systems until the patched version is deployed
Remove membership in trusted-users and allowed-users for accounts that do not require package management privileges

bash

# Configuration example: restrict Nix daemon users in /etc/nix/nix.conf
allowed-users = @wheel
trusted-users = root