CVE-2026-85526: Canonical LXD Path Traversal Vulnerability

CVE-2026-85526 Overview

CVE-2026-85526 is a path traversal vulnerability [CWE-22] in the Btrfs storage driver of Canonical LXD on Linux. The flaw resides in the unpackVolume function and is triggered during an optimized Btrfs backup import. An authenticated user with instance creation privileges can supply a crafted subvolumes[].path entry inside backup/optimized_header.yaml to escape the intended extraction directory. Successful exploitation allows the attacker to delete or replace arbitrary files and directories on the host filesystem as root. Because LXD runs as a privileged daemon, this breaks the container-to-host trust boundary and enables full host compromise from a restricted project.

Critical Impact
An authenticated LXD user can achieve root-level arbitrary file write and deletion on the host via a crafted Btrfs backup archive.

Affected Products

Canonical LXD on Linux (Btrfs storage driver)
LXD instances using the unpackVolume code path for optimized Btrfs backup import
LXD deployments permitting authenticated users to create instances or import backups

Discovery Timeline

2026-09-28 - CVE-2026-85526 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-85526

Vulnerability Analysis

LXD supports importing optimized Btrfs backups that contain a header file, backup/optimized_header.yaml, describing the subvolumes bundled in the archive. During import, the Btrfs storage driver iterates the subvolumes[] array and uses the path field to decide where each subvolume should be unpacked on disk. The unpackVolume function does not canonicalize or constrain these paths to the intended staging directory.

An attacker crafts an archive whose subvolumes[].path values contain traversal sequences such as ../ or absolute paths. When LXD processes the backup, it writes or replaces files outside the storage pool. Because the LXD daemon runs as root, the resulting write operations execute with root privileges on the host.

The scope change in the CVSS vector reflects that an authenticated project-scoped user can affect resources well beyond the project boundary, including host configuration, system binaries, and SSH authorized keys.

Root Cause

The root cause is missing input validation on untrusted path data read from a user-supplied archive. unpackVolume trusts subvolumes[].path from optimized_header.yaml without verifying that the resolved path remains inside the designated extraction root. This is a textbook CWE-22 path traversal, compounded by the daemon running as root.

Attack Vector

Exploitation requires an authenticated account with permission to create instances or import backups. The attacker constructs a malicious optimized Btrfs backup, uploads it through the LXD API or CLI, and triggers import. The traversal sequences in the subvolume path cause the driver to overwrite or delete arbitrary host files. Overwriting files such as /root/.ssh/authorized_keys, systemd units, or sudoers fragments yields full root access on the host.

See the GitHub Security Advisory GHSA-h85r-gjgx-g2rv for upstream technical details.

Detection Methods for CVE-2026-85526

Indicators of Compromise

Unexpected imports of optimized Btrfs backup archives, especially from non-administrative LXD accounts.
Presence of .. sequences or absolute paths inside subvolumes[].path entries in any backup/optimized_header.yaml observed on disk or in archives.
Modification of sensitive host files (/etc/passwd, /etc/shadow, /root/.ssh/authorized_keys, systemd unit files) temporally correlated with LXD backup import activity.
New or modified files on the host owned by root that originate from LXD worker processes outside of storage pool directories.

Detection Strategies

Audit LXD API logs for POST /1.0/storage-pools/.../volumes/custom and instance import endpoints invoked by non-admin users.
Enable Linux audit rules (auditd) on sensitive host directories to flag writes performed by the lxd daemon outside its expected storage pool paths.
Parse LXD daemon logs for Btrfs optimized backup import events and correlate with filesystem change events on the host.

Monitoring Recommendations

Monitor file integrity on /etc, /root, /usr/bin, and /lib/systemd for unexpected changes attributed to the LXD process tree.
Alert on any process spawned by lxd writing outside its storage pool root or snapshot directories.
Track creation of new LXD users, projects, or certificates that grant instance creation privileges.

How to Mitigate CVE-2026-85526

Immediate Actions Required

Upgrade LXD to the fixed release referenced in GHSA-h85r-gjgx-g2rv as soon as the patched snap or distribution package is available.
Revoke instance creation and backup import permissions for any account that does not strictly require them.
Review recent backup imports and audit host filesystem integrity on any LXD host using the Btrfs storage driver.

Patch Information

Canonical has published fixes through the LXD private repository. Relevant pull requests include LXD PR #84, LXD PR #87, LXD PR #103, LXD PR #104, and LXD PR #105. These changes add path validation to the Btrfs unpackVolume routine so that subvolume paths cannot escape the extraction root.

Workarounds

Disable or restrict Btrfs optimized backup imports until the host is patched.
Switch untrusted projects to storage pools that do not use the vulnerable Btrfs driver path.
Enforce role-based access control so that only trusted administrators can import backups or create instances in Btrfs-backed pools.
Isolate the LXD host and limit network reachability of the LXD API to trusted management networks only.

bash

# Restrict backup import privileges by removing the permission from a project role
lxc auth group permission remove untrusted-users project default can_create_instances
lxc auth group permission remove untrusted-users project default can_create_storage_volumes

# Verify installed LXD version includes the GHSA-h85r-gjgx-g2rv fix
snap info lxd | grep -E 'installed|tracking'