Critical severity9.9NVD Advisory· Published Sep 28, 2026· Updated Sep 28, 2026

CVE-2026-85526

Description

Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Canonical/Lxdllm-fuzzy

Patches

Vulnerability mechanics

References

github.com/canonical/lxd-private/pull/103nvd
github.com/canonical/lxd-private/pull/104nvd
github.com/canonical/lxd-private/pull/105nvd
github.com/canonical/lxd-private/pull/84nvd
github.com/canonical/lxd-private/pull/87nvd
github.com/canonical/lxd/security/advisories/GHSA-h85r-gjgx-g2rvnvd

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000