Canonical LXD EUVD-2026-88257

Requires: (1) an authenticated LXD account with instance-creation privileges (PR:L); (2) the host using the Btrfs storage driver; and (3) the attacker performing a btrfs 'optimized' backup import supplying a crafted subvolumes[].path in backup/optimized_header.yaml. The vulnerable code is unpackVolume in the Btrfs storage driver. Limiting factors: exploitation is confined to deployments using the Btrfs backend, needs valid low-privilege API credentials rather than being fully anonymous, and depends on the optimized-backup import feature being reachable to the attacker; no special user interaction is required once these prerequisites are met.

This is a genuinely high-priority vulnerability, not a CVSS-inflated one. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) is internally consistent with the description: a network-reachable LXD API, low complexity, only low privileges (instance-creation rights) needed, no user interaction, and a scope change (S:C) because the flaw escapes the container/backup-import context to write as root on the host filesystem - a container-to-host escape. The C:H/I:H/A:H triad is justified because arbitrary delete/replace of host files as root trivially escalates to full host takeover (overwrite binaries, cron, SSH keys), which also yields confidentiality. Tempering the score: this is authenticated (PR:L), so the attacker must already hold instance-creation privileges on the LXD host, and it is specific to the Btrfs storage backend during an optimized backup import - not every LXD deployment uses Btrfs. No EPSS score, no CISA KEV listing, and no public POC were provided, and the fix lives in a private repo (lxd-private PRs), so mass exploitation signals are currently absent. Net: the flaw is severe and vendor-confirmed with a patch, but real-world urgency depends on how exposed the LXD API is and whether Btrfs is in use - treat as high priority for multi-tenant LXD hosts, lower for single-admin deployments.

An attacker holding a low-privilege LXD account with permission to create instances crafts a malicious btrfs 'optimized' backup archive whose backup/optimized_header.yaml contains a subvolumes[].path entry with path-traversal sequences. When they import it, the Btrfs driver's unpackVolume routine resolves the crafted path outside the intended target and deletes or overwrites host files as root, enabling full host compromise. No public exploit code was identified at the time of analysis, but the vulnerability is vendor-confirmed with an available patch.