Authenticated Denial of Service via Malicious Backup Tarball in LXD
Priority MEDIUM 62CWE-476Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-476.
Summary
Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00548 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed LXD (Canonical): 5.21.5, 6.9github.com/canonical/lxd (Go): 0.0.0-20260622081844-85f897013ccd
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canonical | LXD | 5.21.0 to before 5.21.5; 6.0 to before 6.9 | 5.21.5, 6.9 | Patch available | CNA |
| — | github.com/canonical/lxd (Go) | before 0.0.0-20260622081844-85f897013ccd | 0.0.0-20260622081844-85f897013ccd | Patch available | GHSA-j93m-3j9p-m5m8 |
- LXD VendorCanonical Affected 5.21.0 to before 5.21.5; 6.0 to before 6.9 Fixed in 5.21.5, 6.9 Patch available CNA
- github.com/canonical/lxd (Go) Vendor— Affected before 0.0.0-20260622081844-85f897013ccd Fixed in 0.0.0-20260622081844-85f897013ccd Patch available GHSA-j93m-3j9p-m5m8
Remediation
- Fix · CNA LXD (Canonical) Fixed in 5.21.5, 6.9
- Fix · GHSA-j93m-3j9p-m5m8 github.com/canonical/lxd (Go) Fixed in 0.0.0-20260622081844-85f897013ccd Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-9639
- 2026-11-06 Alias added: GHSA-j93m-3j9p-m5m8
- 2026-11-06 Fix available: Go/github.com/canonical/[email protected] · GHSA-j93m-3j9p-m5m8
- 2026-11-06 CVSS score added · GHSA-j93m-3j9p-m5m8
- 2026-11-06 Weakness changed · GHSA-j93m-3j9p-m5m8
- 2026-11-06 12 new references · GHSA-j93m-3j9p-m5m8
References
Other 8
- https://github.com/canonical/lxd/commit/05bc2729e99707a766d5c4705167a3322c9ef424
- https://github.com/canonical/lxd/commit/c7cdfadb6044dfeaac592dc225978b4125ee23fe
- https://github.com/canonical/lxd/commit/d15520809e6e2ac2af0c6354dfb7be5854b0e859
- https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/9xxx/CVE-2026-9639.json
- https://github.com/canonical/lxd
- https://github.com/canonical/lxd/blob/lxd-5.0.7/lxd/storage/backend_lxd.go
- https://github.com/canonical/lxd/releases/tag/lxd-5.21.5
- https://github.com/canonical/lxd/releases/tag/lxd-6.9
More Canonical Lxd vulnerabilities
- TI-2026-22659 Authenticated RCE via unsanitized compression_algorithm CVSS 4.0CRITICAL 9.4
- TI-2026-47475 Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE CVSS 3.1CRITICAL 9.9
- TI-2026-45146 Cross-project instance move bypasses all project restrictions allowing host command execution CVSS 3.1CRITICAL 9.9
- TI-2026-45143 Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge CVSS 3.1CRITICAL 9.9
- TI-2026-45142 Project restriction bypass via instance migration config override CVSS 3.1CRITICAL 9.9
- TI-2026-45140 Root RCE via image backup.yaml symlink CVSS 3.1CRITICAL 9.9
Sources
- CVE-2026-9639 · CVE Program
- CVE-2026-9639 · NVD
- FIRST EPSS
- GHSA-j93m-3j9p-m5m8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences