CVE-2026-100395

What it is

LXC is a userspace interface for the Linux kernel containment features used to create and manage system containers. In LXC 7.0.0 and earlier, lxc-copy and the public liblxc clone() API can follow attacker-controlled symbolic links while updating /etc/hostname in a copied container root filesystem. The affected surfaces are lxc-copy and liblxc's public lxc_container::clone() API. The privileged cloning process must run as root. The source rootfs must be attacker-controlled or less trusted. A symlink can be placed at etc/hostname or in an intermediate component. The clone operation preserves the symlink before updating the hostname. The vulnerable write truncates and overwrites an existing file outside the destination rootfs. When root clones an untrusted container without LXC_CLONE_KEEPNAME, the copied symlink can resolve outside the destination rootfs and cause the privileged process to overwrite an existing host file with the destination container name. Unprivileged use and managers with independent cloning implementations are not affected. LXC_CLONE_KEEPNAME avoids the hostname update and therefore the affected write.

At a glance

Exploitability

Can be exploited locally on the machine without logging in, but needs a user to act. High risk of data tampering, service disruption.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-25 20:08 UTC ReservedThe CVE id was reserved by its CNA
2. 2026-11-05 22:17 UTC PublishedDisclosed publicly on CVE.org and NVD
3. 2026-11-09 18:17 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 0.2% in the next 30 days (EPSS).
• Severity: 6.8 MEDIUM (CVSS).
• Fix: a patch or advisory is linked.

Details

Published

2026-11-05 22:17 UTC

Last modified

2026-11-09 18:17 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-59

Record status

Received

Attack profile CVSS 4.0 · 6.8

Attack vector

Local

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

Active

Confidentiality

None

Integrity

High

Availability

High

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2026-100395.md and follow it. Check whether this project is affected by CVE-2026-100395. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge