CVE-2026-85526
Publication date 29 September 2026
Last updated 30 September 2026
Ubuntu priority
Description
Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| incus | 26.04 LTS resolute |
Needs evaluation
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy | Not in release | |
| lxd | 26.04 LTS resolute | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
9.9 · Critical
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-85526
- https://github.com/canonical/lxd/security/advisories/GHSA-h85r-gjgx-g2rv
- https://github.com/canonical/lxd-private/pull/103
- https://github.com/canonical/lxd-private/pull/104
- https://github.com/canonical/lxd-private/pull/105
- https://github.com/canonical/lxd-private/pull/84
- https://github.com/canonical/lxd-private/pull/87