No. For CVE-2026-87799, both rsync and optimized btrfs receive transfers can follow symlinks in incoming migration data and write files outside the intended volume on the receiving host. Changing between those paths is not a mitigation; install a fixed LXD release or package, and limit migration and volume-creation access until the fix is in place.
What differs between rsync and Btrfs receive?
The difference is the transfer mechanism LXD invokes, not whether this vulnerability can affect the receiving host. LXD uses rsync on standard instance or custom-volume migration receive paths, and btrfs receive for optimized transfers between Btrfs pools. Canonical says both receivers replay incoming data using host path-based operations that can follow symlinks in paths they write to. Canonical’s LXD advisory describes the vulnerability and its scope.
As an Amazon Associate I earn from qualifying purchases.
| Receive path | Where LXD uses it | CVE-2026-87799 status | Why |
|---|---|---|---|
rsync |
Standard instance or custom-volume migration receive paths | Affected | Later entries can be written through a symlink created earlier in the transfer when parent directories are not retransferred. |
btrfs receive |
Optimized transfers between Btrfs pools | Affected | Stream operations, including file writes and renames, use ordinary path-based calls and are not verified against the intended real filesystem. |
zfs receive |
Optimized ZFS transfers | Not affected by this CVE, according to Canonical | Canonical says this receiver does not resolve host paths. This is a narrow claim about this vulnerability, not a general security guarantee for ZFS. |
How can a migration write outside its volume?
The risk is on the privileged receiving host. A malicious migration source can arrange for an early stream entry to create a symlink such as rootfs pointing to /, then have later entries write through that link. The advisory also describes writes arriving in a subsequent snapshot or main-volume stream. For virtual machines, the corresponding path can involve replacing root.img with a symlink before writing the block stream through it.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The impact described by Canonical is arbitrary attacker-controlled file writes as root, with potential full host compromise. For LXD versions before 7.3.0, the advisory additionally describes a rootfs symlink surviving transfer and being followed by the file API during container chroot, enabling host-file reads as well as writes.
#1 Best Overall
- IronWolf internal hard drives are the ideal solution for up to 8-bay, multi-user NAS environments craving powerhouse performance
- Store more and work faster with a NAS-optimized hard drive providing ultra-high capacity up to 16TB and cache of up to 256MB
- Purpose built for NAS enclosures, IronWolf delivers less wear and tear, little to no noise/vibration, no lags or down time, increased file-sharing performance, and much more
- Easily monitor the health of drives using the integrated IronWolf Health Management system and enjoy long-term reliability with 1M hours MTBF
- Three-year limited warranty protection plan included and three year Rescue Data Recovery Services included
Who can trigger the exposure?
An attacker needs a way to make the target receive malicious migration data. Canonical identifies users who can create instances or custom storage volumes in the target project, as well as an attacker who controls a source server the target is instructed to copy or move from. The practical security boundary is therefore the combination of project permissions and trust in the migration source—not the choice between rsync and Btrfs.
Which LXD versions are fixed?
Canonical’s advisory, published September 25, 2026, lists LXD versions 4.0 and later as affected and names these fixed upstream releases: 4.0.14, 5.0.10, 5.21.8, 6.9-bf243da, and 6.10. The advisory rates the issue Critical with CVSS 9.9. Check the exact package and its backport status for your operating system; a distribution package version and its security-fix status do not necessarily map directly to an upstream version number. Canonical LXD advisory
Rank #2
- Store more, compute faster, and do it confidently with the proven reliability of BarraCuda internal hard drives
- Build a power house gaming computer or desktop setup with a variety of capacities and form factors
- The go to SATA hard drive solution for nearly every PC application from music to video to photo editing to PC gaming. Ax. Sustained transfer rate OD: 190MB/s
- Confidently rely on internal hard drive technology backed by 20 years of innovation
- Frustration Free Packaging - This is just an anti-static bag. No cables, no box.
Ubuntu status
Ubuntu’s CVE page, published September 29 and updated September 30, 2026, also reports CVSS 9.9 Critical, while assigning Ubuntu priority Medium. At the time of that page’s stated update, Ubuntu 26.04, 24.04, and 22.04 were marked “Not in release”; 20.04, 18.04, and 16.04 were marked “Needs evaluation.” These are the page’s displayed statuses, not a statement about other package sources or subsequent updates. Check the current Ubuntu CVE-2026-87799 record for your release.
Free tools Windows power users keep installed
One-click scans. No signup required.
Debian status
At the time accessed, Debian’s tracker listed Bookworm package 5.0.2-5+deb12u6 and Trixie package 5.0.2+git20231211.1364ae4-9+deb13u7 as vulnerable, with unstable shown as unfixed. Confirm the current package record and any vendor backports in the Debian Security Tracker before drawing conclusions about a system.
Rank #3
- IronWolf internal hard drives are the ideal solution for up to 8-bay, multi-user NAS environments craving powerhouse performance.date transfer rate:6.0 gigabits_per_second
- Store more and work faster with a NAS-optimized hard drive providing 8TB and cache of up to 256MB
- Purpose built for NAS enclosures, IronWolf delivers less wear and tear, little to no noise/vibration, no lags or down time, increased file-sharing performance, and much more
- Easily monitor the health of drives using the integrated IronWolf Health Management system and enjoy long-term reliability with 1M hours MTBF
- Three-year limited product warranty protection plan and three year Rescue Data Recovery Services included
What should LXD operators do?
- Install an applicable fixed release or distribution package carrying the fix. Verify the installed package’s security status with the relevant vendor rather than relying only on its upstream-looking version string.
- Until patched, restrict instance and custom-volume creation to trusted clients in the affected target projects.
- Accept migrations only from trusted source servers until the receiving system is fixed.
- Do not treat switching receive paths as a workaround. Both rsync and optimized Btrfs receive are within the advisory’s affected scope. Canonical’s ZFS exception is specific to this CVE and is not a substitute for patching or controlling who can send migration data.
A post-transfer symlink check does not prevent the writes that may already occur while a stream is being applied. The effective response is to fix the receiving LXD installation and limit who can supply data to it.
Quick Recap
Rank #4
- Available in capacities ranging from 2 to 22TB(1) | (1) 1GB = 1 billion bytes and 1TB = 1 trillion bytes. Actual user capacity may be less depending on operating environment.
- For RAID-optimized NAS systems with unlimited number of bays
- Rated for 550TB/yr workload rate(2) | (2) Annualized Workload Rate = TB transferred x (8760 / recorded power-on hours). The maximum rated workload is specified for operating at typical temperature of 40C. Workload Rate will vary depending on your hardware and software components and configurations.
- Designed to handle the demands of high-intensity 24x7 multi-user NAS environments
- Western Digital partners with a wide range of NAS system vendors for extensive testing to ensure compatibility with most NAS enclosures
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
