# CVE-2026-100395: LXC symlink traversal in container cloning

Source: https://junglewise.ai/threats/cve-2026-100395-lxc-is-a-userspace-interface-for-the-linux-kernel-containment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-100395 · Severity: info · Published 2026-11-05

LXC is a tool for creating and managing lightweight Linux containers. When a privileged user clones an untrusted container, a symlink in the /etc/hostname path can be followed to overwrite files outside the container, allowing an attacker to modify host system files. This affects systems where root clones containers from less trusted sources without specific protections enabled.

Vendors: [LXC](https://junglewise.ai/threats/vendors/lxc).

## Quick answers

**Is CVE-2026-100395 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100395 being exploited in the wild.

**How severe is CVE-2026-100395?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** LXC 7.0.0 and earlier.

**Is there a fix for CVE-2026-100395?** No fixed version is recorded yet. Use the LXC_CLONE_KEEPNAME flag when cloning containers to avoid the hostname update and skip the vulnerable write operation. Ensure that container source rootfs are not attacker-controlled or use systems where container operations are performed unprivileged. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-100395 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-100395?** Check whether you run LXC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Use the LXC_CLONE_KEEPNAME flag when cloning containers to avoid the hostname update and skip the vulnerable write operation. Ensure that container source rootfs are not attacker-controlled or use systems where container operations are performed unprivileged.

## Technical details

A symlink traversal vulnerability exists in lxc-copy and liblxc's clone() API where the hostname update process follows attacker-controlled symlinks in the container rootfs. When a privileged process clones a container without the LXC_CLONE_KEEPNAME flag, it opens /etc/hostname for writing without proper symlink containment, allowing a malicious symlink to resolve outside the destination rootfs and overwrite arbitrary host files. The attack requires the source rootfs to be attacker-controlled or less trusted, and the privileged cloning process must run as root; unprivileged users and independent cloning implementations are not affected. Patches use openat2(RESOLVE_IN_ROOT) to ensure symlink resolution stays within the container filesystem.

## Affected products

- LXC LXC 7.0.0 and earlier

## Timeline

- 2026-11-05: disclosed

## References

- [https://github.com/lxc/lxc/commit/6424a91a55efc54edc25ca46e9165bd9f35b50b7](https://github.com/lxc/lxc/commit/6424a91a55efc54edc25ca46e9165bd9f35b50b7)
- [https://github.com/lxc/lxc/commit/fa12709a79c2b63b3918297d7505108fcc840eb6](https://github.com/lxc/lxc/commit/fa12709a79c2b63b3918297d7505108fcc840eb6)