Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an… (CVE-2026-85185)
Description
A path traversal vulnerability exists in the btrfs storage driver of Canonical LXD on Linux, affecting versions 4.0.2 and later before fixed releases. An authenticated client with permission to create instances can delete arbitrary files on the host as root. On hosts with a btrfs root filesystem, the attacker can also place malicious content at arbitrary paths, potentially leading to full host compromise. The attack uses crafted subvolume paths containing ../ sequences in backup or migration headers. Fixes are available in versions 4.0.14, 5.0.10, 5.21.8, and 6.10.
CVSS v3.1
Score 9.6critical
Affected software
pkg:deb/ubuntu/lxd?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/lxd?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/lxd?arch=source&distro=focalpkg:deb/ubuntu/incus?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/incus?arch=source&distro=stonkingpkg:deb/ubuntu/incus?arch=source&distro=esm-apps/resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-85185 describes a path traversal vulnerability in the btrfs storage driver of Canonical LXD on Linux. Authenticated clients authorized to create instances within a project can exploit this flaw by sending crafted subvolume paths containing directory traversal sequences (../) in either the optimized_header.yaml of a btrfs backup or the btrfs migration header. This allows deletion of arbitrary files on the host with root privileges. Additionally, on hosts where the root filesystem is btrfs, the attacker can place attacker-controlled content at arbitrary host paths, enabling full host compromise. The vulnerability affects LXD versions 4.0.2 and later until fixed in 4.0.14, 5.0.10, 5.21.8, and 6.10.
Potential Impact
An authenticated user with instance creation permissions can delete arbitrary files on the host as root, which can disrupt system operations or cause denial of service. On btrfs root filesystem hosts, the attacker can also write arbitrary files to the host, leading to full host compromise. This elevates the attacker's privileges from container-level to root on the host system.
Mitigation Recommendations
Fixes for this vulnerability are available in LXD versions 4.0.14, 5.0.10, 5.21.8, and 6.10. Users should upgrade to one of these fixed versions to remediate the issue. There is no indication that temporary mitigations or workarounds are available or recommended. Applying the official fixes is the advised remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-85185
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:26.10","Ubuntu:Pro:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f5572cdf04f65665e948
Added to database: 10/17/2026, 22:23:19 UTC
Last enriched: 10/17/2026, 23:26:57 UTC
Last updated: 10/17/2026, 23:26:57 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.