BuildIndependently confirmed2 publishers2 min readPublished
Nix and Lix patch a chain of daemon flaws that ends in local root
Nix and Lix jointly disclosed daemon flaws on October 13 that chain into local root, and each project shipped a fixed release that day. Multi-user installs where untrusted users can reach the daemon should upgrade now, Tech AI Wire reports.
The Engineer · Build desk
Timeline: the overflow bug was reported to the Lix team on July 29 and Lix fixes were ready on August 29. The macOS privilege escalation chain arrived on September 12 and the sandbox escape on October 9. Nix and Lix jointly disclosed the flaws on October 13, 2026.
| Date | Event | Claim |
|---|---|---|
| July 29, 2026 | Overflow bug reported to the Lix team | 21 |
| August 29, 2026 | Lix fixes ready for the overflow bug | 22 |
| September 12, 2026 | macOS privilege escalation chain arrives | 16 |
| October 9, 2026 | Sandbox escape arrives | 16 |
| October 13, 2026 | Nix and Lix jointly disclose the flaws | 1 |
What happened
- In the main bug, tracked as GHSA-jwvx-xq5j-gc56, the Nix daemon unpacked an uploaded archive straight into its final store path and checked the hash only afterward.
- Vulnerable versions also let untrusted users request a repair that replaces an existing store path, and a failed hash check left the malicious files on disk.
- Unsupported Nix branches 2.29, 2.32 and 2.33 should be presumed vulnerable, and Lix 2.93 and older are affected but no longer maintained.
Why it matters
- exposure Where the daemon runs as root, every account in allowed-users is effectively a root account until the upgrade. The stopgap offered is to trim that list to the accounts that need to build.
- constraint NixOS users cannot take the fix from the channels yet, because the unstable and 26.05 updates are still in progress. Installs on the unsupported branches have no maintainer to patch them, so in our view their fix is a version change.
- decision Lix operators on 2.95.x have to pick the 2.95.4 upgrade script over plain nix upgrade-nix. An upgrade command that can uninstall what it upgrades is a poor tool for an emergency window.
- cost CI that evaluates pull requests from strangers needs isolated machines for those evaluations, which is new hardware or new VM plumbing for teams that run them on the shared daemon host.
Nix now unpacks uploads into a private temporary folder and moves them into place only after the hash checks out. It also bars untrusted users from repair mode [11]. In our view that is the right fix: nothing reaches the final store path until it has passed the check. The old order dates to Nix 2.1, the release that added streaming uploads [10]. According to Tech AI Wire's summary, the most serious issue lets a local user corrupt files that later run as root [6].
That bug is one of several. Nix has published five GitHub advisories, and none has a CVE number yet [4]. LWN reports that CVE IDs have not been requested [5].
The scope is wider than the one bug. As LWN quotes it, the announcement says: "All systems that build untrusted derivations are affected." [3] In our view, a CI account that builds derivations from outside contributors falls under that sentence even when allowed-users lists only the account itself.
The Lix team's write-up, per Tech AI Wire, shows how long coordination ran [16]. Counting to October 13, 76 days passed between the overflow report and the joint release, and 45 between the ready fix and that release [21][22]. That assumes all the dates fall in 2026. The macOS chain and the sandbox escape arrived inside that window, so the release bundles bugs that reached the team weeks apart [16].
The Lix post is explicit on one point: its daemon should not be treated as a security boundary. For build farms, its recommendation is to run the daemon under an unprivileged account wherever they can [17]. In our view that is the longer-term change for build farms, since patching closes only the bugs found so far.
Installs made with the multi-user script need one more step. The advisory gives commands that make every store path owned by root again [19]. Guix is not affected [15]. The advisory credits Guthrie McAfee Armstrong and a researcher known as joaoviictorti for finding the main bug [12].
What to watch
- Whether the NixOS unstable and 26.05 channel updates land, since until then NixOS hosts cannot patch through the channel.
- Whether CVE IDs get requested and assigned, so that tooling keyed to them can flag affected installs.
- Public detail on the four Nix advisories beyond GHSA-jwvx-xq5j-gc56, which would show how the chain fits together.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap−5
- Incentives
- Insufficient
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Nix and Lix projects jointly disclosed security flaws on October 13, 2026 that can be chained into root access on machines running their package-building daemons.
- [2]
Releases with fixes from each of the Lix and Nix projects were available on the day of the announcement.
- [3]
"All systems that build untrusted derivations are affected."
ReportedSupportedSource: Joint Nix and Lix announcement, as quoted by LWN2 sources— create a free account to open themView cited source - [4]
The Nix side has published five GitHub advisories, and none has a CVE number yet.
- [5]
CVE IDs have not yet been requested for the Nix and Lix vulnerabilities.
- [6]
The most serious of the issues listed in the joint advisory lets a local user corrupt files that later run as root.
- [7]
According to Nix advisory GHSA-jwvx-xq5j-gc56, the daemon unpacked an uploaded archive straight into its final store path and checked the archive's hash only afterward.
- [8]
Vulnerable versions let untrusted users request a repair, which replaces an existing store path; if the hash check failed, the malicious files stayed on disk.
- [9]
When the daemon runs as root, any user listed in allowed-users could execute code as root; until upgrading, Tech AI Wire advises trimming that list to the accounts that need to build.
- [10]
The flaw dates back to Nix 2.1, which added streaming uploads.
- [11]
The fix bars untrusted users from repair mode and unpacks uploads into a private temporary folder, moving them into place only after the hash checks out.
- [12]
The advisory credits Guthrie McAfee Armstrong and a researcher known as joaoviictorti for finding the main bug.
- [13]
The advisory says unsupported Nix branches 2.29, 2.32 and 2.33 should be presumed vulnerable, and Lix 2.93 and older are affected but no longer maintained.
- [14]
Updates are in progress for the NixOS unstable and 26.05 channels.
- [16]
In the Lix team's write-up, the overflow bug was disclosed to the team on July 29 and fixes were ready on August 29; the macOS privilege escalation chain arrived on September 12 and the sandbox escape on October 9.
- [17]
The Lix post stresses that its daemon is not a security boundary and advises build farms to run the daemon as an unprivileged user where possible.
- [18]
The advisory warns that plain nix upgrade-nix can uninstall Lix 2.95.x before installing the new version; the Lix 2.95.4 upgrade script should be used instead.
- [19]
If Nix was installed with the multi-user script, the advisory gives commands to make every store path owned by root again.
- [20]
CI systems that evaluate pull requests from strangers could hit the overflow bug, and Tech AI Wire advises running those evaluations on isolated machines.
- [21]
76 days passed between the July 29 overflow report to the Lix team and the October 13 joint release, assuming all dates fall in 2026.
- [22]
45 days passed between the August 29 date on which Lix fixes were ready and the October 13 joint release, assuming all dates fall in 2026.
Sources
2 independent publishers whose own reporting we read for this story.
- dev.toNix and Lix patch daemon flaws that allow local root
1 article · October 13, 2026
- lwn.netNix and Lix local root-privilege-escalation vulnerabilities
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.