CVE-2026-85185

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.0.2 through 4.0.13 Canonical LXD versions 5.0.0 through 5.0.9 Canonical LXD versions 5.21.0 through 5.21.7 Canonical LXD versions 6.0.0 through 6.9.x

Description A path traversal issue exists in the btrfs storage driver on Linux. An authenticated client with permissions to create instances in a project can delete arbitrary files on the host with root privileges. If the host root filesystem uses btrfs, the client can place controlled content at arbitrary host paths, potentially leading to full host compromise. This is achieved by using a crafted subvolume path containing ../ sequences, which can be delivered via the optimized header.yaml of an optimized btrfs backup or through the btrfs migration header from a malicious migration source.

Recommendations Update to version 4.0.14 Update to version 5.0.10 Update to version 5.21.8 Update to version 6.10