CVE-2026-87799: Arbitrary file write on LXD host via symlink in migration stream
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise. The attacker does this with a crafted rsync or btrfs send stream that plants a symlink in the transferred volume, such as rootfs or root.img, and then writes through it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Canonical LXDto a version that resolves this vulnerability.Fixed in 4.0.14 - Upgrade
Upgrade
Canonical LXDto a version that resolves this vulnerability.Fixed in 5.0.10 - Upgrade
Upgrade
Canonical LXDto a version that resolves this vulnerability.Fixed in 5.21.8 - Upgrade
Upgrade
Canonical LXDto a version that resolves this vulnerability.Fixed in 6.10
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated LXD client that can create instances or custom storage volumes in a project can exploit it. A malicious migration source server can also exploit a target that receives its migration stream.
Does exploitation require interaction from another user?
No. The supplied vector indicates no user interaction is required, but the attacker needs either the relevant authenticated LXD project permissions or control of a migration source server.
What is the impact on the target host?
A crafted rsync or btrfs send stream can create a symlink in a transferred volume and write through it to an arbitrary host path as root. This can lead to full compromise of the LXD host.
Which LXD releases contain fixes?
Fixes are identified in LXD 4.0.14, 5.0.10, 5.21.8, and 6.10. The issue affects LXD 4.0 and later before the applicable fixed release.