CVE-2026-85185

Executive Summary

CVE-2026-85185 is a critical path traversal vulnerability (CWE-22) in the btrfs storage driver of Canonical LXD, affecting versions 4.0.2 and later. An authenticated client with permission to create instances within a project can supply a crafted subvolume path containing ../ sequences to delete arbitrary files on the host as root. On hosts where the root filesystem is btrfs, the attacker can additionally write attacker-controlled content to arbitrary host paths, resulting in full host compromise. With a CVSS score of 9.6, this represents a severe multi-tenant isolation escape for any LXD deployment relying on btrfs storage backends.

Technical Analysis

LXD is Canonical's system container and virtual machine manager, commonly used in multi-tenant cloud and hosting environments where multiple projects share a single host. The btrfs storage driver is one of several storage backends LXD supports for managing instance root filesystems as btrfs subvolumes.

The vulnerability resides in how the btrfs storage driver handles subvolume paths received from a client. Per the NVD description, a crafted subvolume path containing ../ sequences is not properly normalized or constrained to the project's storage boundary. Because the LXD daemon runs as root, path traversal escaping the intended subvolume directory allows the attacker to reach arbitrary paths on the host filesystem with root privileges.

Two distinct injection vectors are described:

1. Optimized btrfs backup import — the malicious path is embedded in the optimized_header.yaml of an optimized btrfs backup. When an authenticated client with instance-creation permission imports such a backup, the driver processes the attacker-supplied header and applies the crafted subvolume path.
2. Btrfs migration header — the malicious path is embedded in the btrfs migration header sent by a malicious migration source. During a migration operation, LXD processes this header and again applies the unvalidated path.

The core weakness is the absence of canonicalization and boundary enforcement on paths received from a semi-trusted client role. The client only needs permission to create instances in a project—a relatively low-privilege role in typical multi-tenant LXD configurations—which means the attack surface is broad in shared hosting environments.

The impact differs by host filesystem:

• Non-btrfs root filesystem hosts: The traversal enables deletion of arbitrary host files as root. This is destructive (availability/integrity of host files) but does not by itself provide content-placement primitives.
• Btrfs root filesystem hosts: The traversal enables both deletion and placement of attacker-controlled content at arbitrary host paths as root. This is the path to full host compromise, as an attacker can write to sensitive locations such as configuration files, scheduled tasks, or binaries executed by privileged processes. Critically, the CVSS vector reflects high integrity impact (I:H) and high availability impact (A:H), with no confidentiality impact (C:N) and a changed scope (S:C), consistent with an escape from the container/project boundary into the host.

No public proof-of-concept, exploit code, or Nuclei template is currently available, and the CVE is not listed in CISA KEV. The mechanism is nonetheless straightforward to reason about at the vulnerability-class level, and the CVSS vector indicates network attack vector (AV:N), low attack complexity (AC:L), and low privileges required (PR:L).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the details provided in the NVD description. Only the artifacts named in the description are referenced.

1) Reconnaissance / target identification. The attacker must first obtain authenticated access to an LXD API endpoint and possess permission to create instances in at least one project. This is a low-privilege, typical role in multi-tenant environments. The attacker then determines the storage backend of the target (btrfs vs. other drivers) and, if possible, whether the host root filesystem is btrfs—the latter scenario is significantly more impactful. Identifying a target is a function of the exposed LXD API and the attacker's assigned project permissions rather than an unauthenticated network scan.

2) Triggering the flaw. The attacker exercises one of the two injection vectors described in the NVD entry:

• Vector A — optimized btrfs backup: The attacker prepares an optimized btrfs backup whose optimized_header.yaml contains a crafted subvolume path containing ../ sequences, then imports it via the standard instance-creation/import workflow.
• Vector B — malicious migration source: The attacker operates (or impersonates) a migration source and sends a btrfs migration header containing the crafted ../ sequence during a migration operation.

In both cases, the driver processes the path without adequately constraining it to the project's storage boundary.

3) Payload / execution primitives. Because the ../ sequences escape the intended subvolume directory, the driver—running as root—operates on paths outside the project boundary. The immediate effect is arbitrary file deletion on the host. On btrfs root filesystem hosts, the same primitive allows the attacker to place attacker-controlled content at arbitrary host paths, converting a destructive primitive into an arbitrary-write primitive.

4) Post-exploitation impact. On non-btrfs-root hosts, the attacker achieves destructive impact against host files as root, with availability and integrity consequences. On btrfs-root hosts, the arbitrary-write primitive permits placement of attacker-controlled content at arbitrary paths, enabling full host compromise by influencing files or resources consumed by privileged host processes. The changed-scope CVSS metric captures this escape from the project boundary to the host. The attacker requires only the instance-creation permission, so impacts propagate across all tenants and workloads on the affected host, not just the attacker's own project.

Impact Assessment

The CVSS score is 9.6 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H:

• Attack Vector (Network): The LXD API is remotely reachable, so exploitation does not require local access to the host.
• Attack Complexity (Low): No race conditions or unusual preconditions; the crafted path is processed directly.
• Privileges Required (Low): Only authenticated instance-creation permission in a project is needed—no administrative host access.
• User Interaction (None): No victim action is required beyond normal LXD operation.
• Scope (Changed): The vulnerability crosses a security boundary—from the project/instance context to the host.
• Confidentiality (None): The described primitives are deletion and content placement, not direct data reading.
• Integrity (High): Arbitrary file deletion and (on btrfs-root hosts) attacker-controlled content at arbitrary paths.
• Availability (High): Deletion of arbitrary host files can disrupt or destroy host services.

Blast radius: Every LXD host running an affected version with the btrfs storage driver is in scope, particularly multi-tenant deployments where untrusted or semi-trusted tenants hold instance-creation permissions. The most severe outcome—full host compromise—applies to hosts whose root filesystem is btrfs. Non-btrfs-root hosts are still exposed to root-level arbitrary file deletion. A successful escape compromises all projects and workloads on that host, not merely the attacker's tenant. Business impact ranges from destructive data loss and service outage to complete host takeover, depending on filesystem layout and attacker objectives.

Detection Guidance

Sigma Rule

title: Potential LXD btrfs Path Traversal Attempt (CVE-2026-85185)
id: 8f3c1a72-4b2e-4d5a-9c11-1c7e9b0a6f01
status: experimental
description: Detects LXD operations referencing traversal sequences in backup/migration contexts consistent with CVE-2026-85185 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85185
author: valtersit.com
date: 2026-01-01
logsource:
  product: linux
  service: lxd
detection:
  selection_traversal:
    message|contains:
      - '../'
      - '..%2f'
      - '%2e%2e%2f'
  selection_context:
    message|contains:
      - 'optimized_header.yaml'
      - 'btrfs'
      - 'migration'
      - 'backup'
  condition: selection_traversal and selection_context
fields:
  - message
  - user
level: high
falsepositives:
  - Legitimate administrative operations referencing parent paths in unrelated contexts

YARA Rule

rule CVE_2026_85185_LXD_BTRFS_Traversal
{
    meta:
        description = "Detects LXD btrfs backup/migration artifacts containing traversal sequences (CVE-2026-85185)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85185"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $hdr = "optimized_header.yaml" ascii wide
        $btrfs = "btrfs" ascii wide nocase
        $trav1 = "../" ascii
        $trav2 = "..%2f" ascii nocase
        $trav3 = "%2e%2e%2f" ascii nocase
        $subvol = "subvolume" ascii wide nocase

    condition:
        (uint32(0) == 0x04034b50 or filesize > 0) and
        ($hdr or $subvol) and $btrfs and any of ($trav*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85185 LXD btrfs path traversal attempt in backup/migration upload"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/1.0/"; content:"backups" or content:"migration"; http.request_body; content:"../"; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; reference:cve,2026-85185; sid:202685185; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [ process where event.type == "start" and
      process.name == "lxd" and
      process.args : ("*backup*", "*migration*", "*import*") ]
  [ file where event.action in ("deletion", "creation") and
      process.name == "lxd" and
      not file.path : ("/var/snap/lxd/*", "/var/lib/lxd/*", "/var/lib/snapd/*") ]

Splunk SPL Query

index=linux sourcetype=lxd:server
| search (backup OR migration OR import OR optimized_header)
| where match(message, "(\.\./|%2e%2e%2f|\.\.%2f)")
| stats count values(message) as evidence by host, user, src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="lxd,cve-2026-85185,">
  <rule id="100850" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">lxd</field>
    <regex type="pcre2">(?i)(\.\./|%2e%2e%2f|\.\.%2f)</regex>
    <description>CVE-2026-85185: LXD btrfs path traversal attempt detected in backup/migration operation</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>lxd_exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED — with no patch evidence from any tracked source, no vendor fix reference, and no documented workarounds.

1) Immediate mitigations

• Restrict instance-creation permission to fully trusted users only; treat it as a privileged role for as long as the vulnerability remains unpatched.
• Where feasible, avoid the btrfs storage driver and migrate instances to a non-btrfs backend. This eliminates the arbitrary-write/full-compromise path, though the arbitrary-deletion primitive is not necessarily removed.
• Isolate LXD API endpoints from untrusted networks; require strong authentication and network segmentation.
• Audit and tightly limit who can import optimized btrfs backups or act as a migration source/target within LXD projects.
• Monitor for and review any backup import or migration operations referencing parent-directory sequences.

2) Patch/upgrade steps

• Upgrade to fixed releases: LXD 4.0.14, 5.0.10, 5.21.8, or 6.10 (or later). These versions are documented as containing the fix for the traversal issue.
• Validate post-upgrade that the storage driver rejects subvolume paths containing ../ sequences in both the optimized_header.yaml import path and the migration header path.
• Given the absence of independent patch-confidence evidence, verify the fix behavior directly in a test environment after upgrading.

3) Long-term hardening

• Enforce strict path canonicalization and boundary checks on all client-supplied storage paths, constraining them to the project's storage directory.
• Apply least-privilege principles to LXD project roles; avoid granting instance-creation permissions broadly in multi-tenant environments.
• Separate storage backends and host root filesystems where possible to reduce the impact of storage-driver flaws.
• Maintain timely upgrade cadence and subscribe to Canonical LXD security advisories for future fixes.

References

• NVD — CVE-2026-85185: https://nvd.nist.gov/vuln/detail/CVE-2026-85185
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
• Canonical LXD documentation and security advisories: https://canonical.com/lxd
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE as of this writing, and CVE-2026-85185 is not listed in CISA KEV. No threat actor campaigns or confirmed in-the-wild exploitation evidence have been reported.