← Back to the live CVE advisory feed

CVE-2026-87799: Product identification pending

Severity

9.9 (CRITICAL)

Vendor

UBUNTU

Fixed version

4.0.14

Patch status

Patched

Published

2026-09-28T14:17:21.427

Modified

2026-09-28T17:17:51.787

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise. The attacker does this with a crafted rsync or btrfs send stream that plants a symlink in the transferred volume, such as rootfs or root.img, and then writes through it.

View the official NVD record for CVE-2026-87799

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.