CVE-2026-87799 Versus CVE-2026-85185: Symlink Replay and Unvalidated Subvolume Paths Compared
Two ways to escape the same volume
CVE-2026-87799 and CVE-2026-85185 both let LXD act outside the storage volume it was asked to write to. They differ in mechanism, in the code that fails, and in which hosts they reach.
Comparing them is useful because the mitigations overlap only partially and the affected version ranges are not identical.
CVE-2026-87799: following a link that should not exist
This is CWE-59, rated 9.9. LXD receives an instance or custom volume through migration and delegates the replay to rsync or to btrfs receive. Both tools use path-based system calls and neither refuses to traverse a symlink planted earlier in the same stream. Later entries travel through the link and are written as root outside the destination volume.
The attacker's contribution is ordering: place the link first, reference it later. The affected versions are LXD 4.0 and later, and optimized ZFS transfers are not affected.
CVE-2026-85185: trusting a path field
This is CWE-22, rated 9.6. The btrfs storage driver reads a subvolume path field from attacker-supplied backup or migration headers and joins it to the pool mount point without a containment check. A path that climbs out of the pool then reaches file removal and rename operations executed as root.
There is no symlink involved. The defect is the absence of a containment check on a value that arrives from an untrusted peer. The affected range is LXD 4.0.2 and later.
The advisory is explicit that this is a distinct sink from the earlier fixes for CVE-2026-66897 and CVE-2026-66898, which matters for anyone who assumed the previous cycle closed the class.
Side-by-side summary
| Aspect | CVE-2026-87799 | CVE-2026-85185 |
|---|---|---|
| Weakness | CWE-59 link following | CWE-22 path traversal |
| CVSSv3 | 9.9 | 9.6 |
| Trigger | Migration stream replay via rsync or btrfs receive | btrfs subvolume path from backup or migration headers |
| Driver dependence | Not btrfs-specific; optimized ZFS unaffected | btrfs subvolume operations |
| Affected since | LXD 4.0 | LXD 4.0.2 |
| Root outcome | Arbitrary root-owned file writes outside the volume | File removal and rename operations as root outside the pool |
| Fixed in | 4.0.14, 5.0.10, 5.21.8, 6.10 | 4.0.14, 5.0.10, 5.21.8, 6.10 |
Operational consequences of the difference
An operator who only accepts migrations and never touches btrfs subvolume headers still carries the symlink risk on the default rsync path. An operator who has moved to optimized ZFS transfers for the symlink flaw can still be exposed to the subvolume-path flaw if btrfs pools exist elsewhere in the fleet.
An inventory therefore needs two questions per host: what is the storage driver, and which inbound operations are permitted.
Exposure evidence
A ZoomEye query for app="LXD" returns 12,153 assets as of 29 September 2026. Fingerprinting cannot separate hosts by driver or by permitted operation, so this figure bounds the population rather than the vulnerable subset.
Remediation
Upgrade to LXD 4.0.14, 5.0.10, 5.21.8, 6.10, or the fixed 6.9 commit bf243da. While the rollout completes, restrict instance and custom volume creation to trusted users, migrate only from trusted servers, do not import btrfs optimized backups from untrusted sources, and block backup import for non-admin members in multi-tenant projects.
References
- SecurityOnline, "Critical LXD Vulnerabilities Let Container Users Write Files as Root on the Host": https://securityonline.info/lxd-vulnerabilities-host-root/
- Official LXD security advisories on GitHub (distinct-sink note and per-CVE fixed releases)
