CVE-2026-85526

Executive Summary

CVE-2026-85526 is a path traversal vulnerability in the Btrfs storage driver of Canonical LXD (unpackVolume) on Linux, rated CVSS 9.9. An authenticated user holding instance creation privileges can supply a crafted subvolumes[].path entry inside backup/optimized_header.yaml during a btrfs optimized backup import, causing deletion or replacement of arbitrary files and directories on the host filesystem with root privileges. The scope change (S:C) reflects that the flaw crosses from the LXD instance/container trust boundary into the host OS, making a compromise effectively full host takeover. No public exploit code, PoC, or Nuclei template is currently available, and no vendor patch has been confirmed.

Technical Analysis

LXD supports optimized backups that preserve storage-driver-native structures such as Btrfs subvolumes rather than streaming a flattened tar archive. When such a backup is imported, LXD parses a YAML manifest — described in the advisory as backup/optimized_header.yaml — which declares the subvolumes belonging to the backup along with a subvolumes[].path field describing where each subvolume lives.

During import, the Btrfs storage driver's unpackVolume routine consumes these declared paths and reconstructs the subvolume on the target host. Because the declared path originates from the backup artifact (attacker-controlled input) and is not adequately validated or confined to the instance's own storage directory, an attacker can embed traversal sequences (e.g., ../ style components, per the CWE-22 classification) in subvolumes[].path. The result is that reconstruction and any associated delete/replace operations occur at a location chosen by the attacker rather than inside the instance's storage area.

The impact class is arbitrary file and directory deletion or replacement performed as root on the host. This is a classic "escape the container/instance boundary" path-traversal defect: the LXD daemon runs with high privilege, so path operations it performs are host-wide in effect. The CVSS vector reflects network reachability (AV:N, e.g., via the LXD API), low privileges required (PR:L — only instance-creation rights), no user interaction (UI:N), and changed scope (S:C) because the vulnerable component's exploitation affects resources beyond its original security authority — the host filesystem. High confidentiality, integrity, and availability impacts follow directly: replacing root-owned files (for example, configuration, binaries, or service unit files) can yield code execution, and deleting arbitrary directories can render the host unusable.

No CVE-assigned CNA title was supplied and no affected version range was published in the provided data, so the precise vulnerable release set cannot be enumerated here. The defect is specific to the Btrfs storage driver's optimized-backup import path; other storage drivers or non-optimized import flows are not indicated by the description. Insufficient technical detail is available to name the exact validation routine that fails — only unpackVolume (the Btrfs storage driver function) and the manifest file backup/optimized_header.yaml with its subvolumes[].path field are named in the source material, and this report deliberately does not fabricate additional code-level identifiers.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the details present in the NVD description. Only the artifacts named in that description are referenced.

1. Reconnaissance / target identification. The attacker identifies a host running Canonical LXD with the Btrfs storage driver enabled and determines that they possess (or can obtain) an account with permissions to create instances. Reachability is assumed via LXD's network-exposed management interface (consistent with AV:N). Target selection is a function of privilege, not exploit skill: any authenticated principal able to trigger a backup import qualifies.

2. Triggering the specific flaw class. The attacker prepares a btrfs optimized backup whose backup/optimized_header.yaml contains a subvolumes[].path value crafted with path-traversal sequences. The vulnerability class (CWE-22) means the attacker's declared path escapes the intended base directory when the storage driver resolves it.

3. Payload / execution method (vulnerability-class level). The attacker initiates an import of the crafted backup. During import, the Btrfs driver's unpackVolume processes the hostile subvolumes[].path and attempts to reconstruct (and where applicable remove/replace) the targeted location on the host. No code execution primitive is needed to start: the traversal itself directs a privileged filesystem operation. The attacker is not required to supply a separate payload binary — the manifest entry is the attack vehicle. Because no PoC exists publicly, details of a working traversal string and the precise success conditions cannot be stated and are not invented here.

4. Post-exploitation impact. Success yields deletion or replacement of arbitrary host files/directories as root (C/I/A:H). Practical follow-on effects consistent with that capability include overwriting privileged configuration or executables to gain persistent code execution as root, or destroying critical host data to cause denial of service. The scope change (S:C) means the compromise is not confined to the attacker's own instance but affects the host operating system and any other instances it hosts.

Impact Assessment

CVSS 3.1 base score 9.9 (Critical) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

• Attack Vector (N): exploitable remotely over the network, consistent with LXD's API surface.
• Attack Complexity (L): no special conditions beyond possessing instance-creation rights and delivering a crafted backup manifest.
• Privileges Required (L): the attacker only needs an authenticated account with instance-creation privileges — a low bar in multi-tenant or delegated-administration LXD deployments.
• User Interaction (N): no victim action required.
• Scope (C): the flaw escapes the instance boundary and affects the host — the key driver of the severity.
• Confidentiality/Integrity/Availability (H/H/H): root-level file replacement can expose data, corrupt the system, or enable code execution; root-level deletion threatens availability.

Blast radius: the single affected host, and every container/VM instance running on it, since all are under the same privileged daemon. In clustered LXD environments, compromise of one member node can affect workloads scheduled there. Business impact: full host compromise, lateral-movement staging point, potential data destruction, and violation of tenant isolation in shared hosting. Who is affected: operators running Canonical LXD with the Btrfs storage driver who grant instance-creation permissions to non-fully-trusted users.

Detection Guidance

Sigma Rule

title: LXD Btrfs Optimized Backup Import with Path Traversal in subvolumes path (CVE-2026-85526)
id: 7f3c1a9e-2b64-4d1a-9c33-8e5d0b2f6a11
status: experimental
description: Detects import of LXD optimized backups whose manifest references subvolume paths containing traversal sequences, targeting the Btrfs storage driver unpackVolume path.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85526
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_proc:
    type: 'EXECVE'
    Image|endswith:
      - '/lxd'
      - '/lxd-agent'
  selection_manifest:
    CommandLine|contains:
      - 'optimized_header.yaml'
      - 'subvolumes'
  selection_traversal:
    CommandLine|contains:
      - '../'
      - '..\\'
  condition: selection_proc and (selection_manifest or selection_traversal)
falsepositives:
  - Legitimate administrative backup imports referencing relative paths
level: high
tags:
  - attack.t1222
  - cve.2026.85526

YARA Rule

rule CVE_2026_85526_LXD_Btrfs_Traversal_Manifest
{
    meta:
        description = "Detects LXD optimized backup manifests (optimized_header.yaml) abusing subvolumes[].path traversal in the Btrfs driver (CVE-2026-85526)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85526"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $manifest = "optimized_header.yaml" ascii wide nocase
        $subvol   = "subvolumes" ascii wide nocase
        $pathkey  = "path:" ascii wide nocase
        $trav1    = "../" ascii wide
        $trav2    = "..\\" ascii wide

    condition:
        $manifest and $subvol and $pathkey and any of ($trav*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85526 LXD Btrfs optimized backup import path traversal (subvolumes path)"; flow:to_server,established; http.method; content:"POST"; http.request_body; content:"subvolumes"; nocase; content:"path"; nocase; content:"../" ; nocase; reference:cve,2026-85526; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85526; classtype:attempted-admin; sid:202685526; rev:1;)

### Elastic Detection

sequence by host.id with maxspan=5m [ process where event.type == "start" and process.name in ("lxd", "lxd-agent") ] [ file where file.name == "optimized_header.yaml" or (file.path : "optimized_header.yaml" and file.path : "subvolumes") ]

(Supplemental: alert on any LXD import event where auditd records a `subvolumes[].path` value containing `../`.)

### Splunk SPL Query
```spl
index=linux sourcetype=auditd
(process_name IN ("lxd","lxd-agent") OR exe IN ("/usr/bin/lxd","/usr/sbin/lxd","/usr/bin/lxd-agent","/usr/sbin/lxd-agent"))
(cmdline="*optimized_header.yaml*" OR cmdline="*subvolumes*" OR cmdline="*../*")
| table _time host process_name exe cmdline user
| sort - _time

Wazuh OSSEC Rule

<group name="lxd,cve-2026-85526,">
  <rule id="20265526" level="12">
    <decoded_as>json</decoded_as>
    <field name="process">lxd|lxd-agent</field>
    <field name="command">\.\./</field>
    <description>CVE-2026-85526: LXD Btrfs optimized backup import with path traversal in subvolumes[].path</description>
    <mitre>
      <id>T1222</id>
    </mitre>
    <group>cve_2026_85526,</group>
  </rule>

  <rule id="20265527" level="10">
    <decoded_as>json</decoded_as>
    <field name="file">optimized_header.yaml</field>
    <description>CVE-2026-85526: LXD optimized backup manifest observed during import</description>
    <group>cve_2026_85526,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range was provided in the intelligence data.

1. Immediate mitigations.

   • Restrict instance-creation privileges. Because exploitation requires only instance-creation rights (PR:L), remove or tightly scope these permissions for non-fully-trusted users; audit who currently holds them.
   • Treat btrfs optimized backup import as a privileged operation. Require backups to originate from trusted administrators/roots of trust only; validate provenance before import.
   • Do not accept backup artifacts (backup/optimized_header.yaml and the associated subvolume data) from untrusted or external sources.
   • Where feasible, consider migrating the affected storage pool off the Btrfs driver, or disable optimized-backup import until a fix is available, as a temporary containment measure.
   • Isolate the LXD management API behind network access controls so only trusted networks can reach it (reduce AV:N exposure).
   • Retain immutable/off-host backups of root-owned host files to recover from destructive deletion/replacement.

2. Patch / upgrade steps.

   • Closely monitor Canonical LXD security advisories (USN) for CVE-2026-85526; no patch is currently confirmed. Subscribe to the LXD and Ubuntu security notice feeds and apply the vendor release as soon as it lands.
   • When a fix is published, upgrade LXD via the supported channel (e.g., snap or APT) and restart the daemon, then re-verify the affected storage driver behavior.

3. Long-term hardening.

   • Enforce least privilege for LXD API users; adopt project isolation and restricted API extensions rather than broad instance-creation rights.
   • Sanitize and canonicalize all paths derived from untrusted artifacts at the driver layer (path confinement to the instance storage root) — this is the required upstream fix class.
   • Run LXD daemons with defense-in-depth controls (e.g., Mandatory Access Control profiles) that limit which host paths the daemon and storage drivers may modify.
   • Add integrity monitoring on critical host paths to detect unexpected root-level file replacement/deletion.
   • Maintain a patch-monitoring process that tracks vendor advisories and EPSS/NVD updates for this CVE (EPSS currently not yet scored by FIRST.org; do not rely on a fabricated EPSS value).

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85526
• CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
• Canonical LXD security notices (monitor for the USN addressing CVE-2026-85526): https://ubuntu.com/security/notices
• Canonical LXD backup/storage documentation (btrfs driver, backup import): https://documentation.ubuntu.com/lxd/
• MITRE ATT&CK T1222 — File and Directory Permissions Modification: https://attack.mitre.org/techniques/T1222/

Threat actor / exploit-in-the-wild status: None. This CVE is not listed in CISA KEV, no public PoC or exploit code exists, no Nuclei template is available, and there is no reported campaign exploiting CVE-2026-85526 at the time of writing. EPSS has not yet been scored by FIRST.org.