CVE-2026-85185: Canonical LXD Path Traversal Vulnerability

CVE-2026-85185 Overview

CVE-2026-85185 is a path traversal vulnerability [CWE-22] in the btrfs storage driver of Canonical LXD. The flaw affects LXD versions 4.0.2 and later on Linux. An authenticated client with permission to create instances in a project can delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths. This condition leads to full host compromise. The vulnerability is triggered through a crafted subvolume path containing ../ sequences, delivered in either the optimized_header.yaml of an optimized btrfs backup or in the btrfs migration header sent by a malicious migration source.

Critical Impact
An authenticated project user can escape the storage subvolume boundary, delete arbitrary host files as root, and achieve full host compromise on btrfs-rooted systems.

Affected Products

Canonical LXD versions 4.0.2 through 4.0.13
Canonical LXD 5.0.x prior to 5.0.10 and 5.21.x prior to 5.21.8
Canonical LXD 6.x prior to 6.10

Discovery Timeline

2026-09-28 - CVE-2026-85185 published to the National Vulnerability Database
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-85185

Vulnerability Analysis

The vulnerability resides in the btrfs storage driver used by LXD to manage instance subvolumes. LXD trusts subvolume path values supplied in backup and migration metadata without normalizing or sandboxing them. An authenticated client with the can_create_instances permission on a project can submit a crafted path that escapes the intended storage pool directory. Because LXD operates as root on the host, filesystem operations derived from the attacker-controlled path execute with root privileges. On hosts where the root filesystem is btrfs, the driver can create or replace subvolumes at arbitrary locations, letting an attacker drop controlled content into sensitive paths such as /etc, /root/.ssh, or systemd unit directories.

Root Cause

The root cause is missing validation of the subvolume path field parsed from the optimized_header.yaml component of optimized btrfs backups and from the btrfs migration header sent during instance migration. The driver resolves these paths relative to the storage pool without rejecting ../ traversal sequences or canonicalizing the result against an allow-list of permitted directories.

Attack Vector

Exploitation requires an authenticated LXD client with permission to create instances in at least one project. The attacker triggers either of two code paths. First, they can upload an optimized btrfs backup whose optimized_header.yaml references a traversal path. Second, they can operate a malicious migration source and inject the traversal path into the btrfs migration header consumed by the target. See the GitHub Security Advisory GHSA-27q7-qwhm-c34p for additional technical context.

Detection Methods for CVE-2026-85185

Indicators of Compromise

Unexpected btrfs subvolumes or files appearing outside the configured LXD storage pool directory, particularly under /etc, /root, /var/lib, or /usr/lib/systemd.
LXD daemon log entries referencing backup import or migration operations with subvolume paths containing ../ sequences.
Deletion or truncation of host files coinciding with LXD instance creation, restore, or migration activity.

Detection Strategies

Inspect the contents of optimized_header.yaml within any uploaded btrfs backup archives for path values containing .. or absolute paths outside the storage pool.
Correlate LXD API audit events for POST /1.0/instances and migration endpoints with filesystem change events on the host.
Review the integrity of system binaries, SSH authorized key files, and systemd unit files on hosts running vulnerable LXD versions with a btrfs root filesystem.

Monitoring Recommendations

Enable LXD audit logging and forward daemon logs to a centralized log pipeline for retention and query.
Monitor filesystem integrity on host paths outside the LXD storage pool using tooling such as auditd or fanotify.
Track the LXD daemon version across the fleet and alert on hosts running versions earlier than 4.0.14, 5.0.10, 5.21.8, or 6.10.

How to Mitigate CVE-2026-85185

Immediate Actions Required

Upgrade LXD to a fixed release: 4.0.14, 5.0.10, 5.21.8, or 6.10.
Audit project membership and revoke instance-creation permissions for untrusted users until patching is complete.
Treat any backup or migration payload received from an untrusted source as potentially malicious and quarantine it pending review.

Patch Information

Canonical fixed the vulnerability in LXD 4.0.14, 5.0.10, 5.21.8, and 6.10. Apply the update via the snap channel or distribution package appropriate for the deployment. Refer to the GitHub Security Advisory GHSA-27q7-qwhm-c34p for the complete list of fixed versions and commit references.

Workarounds

Restrict the can_create_instances permission to trusted operators only until the patch is deployed.
Disable the acceptance of optimized btrfs backups and incoming btrfs migrations from untrusted sources.
Where feasible, migrate the host root filesystem off btrfs to limit the arbitrary-write impact to file deletion only.

bash

# Verify installed LXD version and upgrade via snap
lxd --version
sudo snap refresh lxd --channel=5.21/stable