Symbolic Link Vulnerability in LXC 7.0.0 and Earlier Versions

CVE-2026-100395

What is CVE-2026-100395?

LXC, a userspace interface for managing Linux containers, has a significant vulnerability in versions up to 7.0.0. This occurs when the lxc-copy command and the liblxc clone() API follow attacker-controlled symbolic links while updating the /etc/hostname in a copied container root filesystem. Specifically, the vulnerability arises from the cloning process that retains symbolic links. If the privileged cloning process runs as root and the source filesystem is directed by an attacker, a symlink placed in etc/hostname or an intermediate directory can result in overwriting a sensitive file outside the intended container root filesystem. This vulnerability highlights the risks when cloning untrusted containers without proper safeguards, such as the LXC_CLONE_KEEPNAME setting.

References