CVE-2026-100395

Name of the Vulnerable Software and Affected Versions LXC versions 7.0.0 and earlier

Description In the lxc-copy utility and the public lxc container::clone() API, a flaw exists where the process can follow attacker-controlled symbolic links when updating the /etc/hostname file in a copied container root filesystem. This occurs when a privileged cloning process running as root clones a source rootfs that is attacker-controlled or less trusted. If a symlink is placed at etc/hostname or within an intermediate component, the clone operation preserves this symlink. When the process attempts to update the hostname without the LXC CLONE KEEPNAME flag, the write operation can resolve outside the destination rootfs, allowing the privileged process to truncate and overwrite an existing host file with the destination container name.

Recommendations Update LXC to a version later than 7.0.0. Use the LXC CLONE KEEPNAME flag during the cloning process to avoid the hostname update and prevent the affected write operation.