CVE-2026-9639: LXD Nil-Pointer Dereference DoS Vulnerability (CVSS 6.5)

Technical summary

The vulnerability is a nil-pointer dereference in the CreateCustomVolumeFromBackup function. When processing a custom-volume backup tarball, the code fails to validate the presence of the expires_at field in snapshot metadata. If this field is omitted, the function attempts to dereference a null pointer, triggering a crash. The issue is rooted in CWE-476 (NULL Pointer Dereference) and requires the attacker to hold can_create_storage_volumes permissions within the LXD instance. The flaw exists in LXD versions through 6.8 (latest stable) and 5.21 (prior stable branch).

Business impact

This vulnerability enables resource exhaustion attacks against LXD deployments. A malicious or compromised insider with storage volume creation rights can repeatedly crash the LXD daemon, disrupting container and VM operations. For organizations using LXD to host production workloads or multi-tenant environments, repeated crashes result in availability loss, service interruptions, and operational overhead for recovery. The attack requires no network traversal—only valid authentication—making it particularly relevant for environments with untrusted or overprivileged users.

Affected systems

LXD versions up to 6.8 and 5.21 on Linux are vulnerable. Both the current stable release (6.x series) and the prior long-term support branch (5.x series) are in scope. Systems running earlier versions are also affected. The Linux kernel itself is not the attack vector; only LXD's container management layer is vulnerable. Other container runtimes (Docker, containerd, Kubernetes) are not affected by this specific flaw.

Exploitability

Exploitation requires valid LXD credentials and the can_create_storage_volumes permission. An attacker cannot exploit this remotely without authentication. The attack surface is limited to users or service accounts with explicit storage volume creation rights. No advanced exploit code or zero-day techniques are necessary—a specially crafted tarball is sufficient. The low attack complexity (AC:L) and lack of user interaction (UI:N) mean that once access is gained, exploitation is straightforward. This is not in the CISA KEV catalog, indicating no known active exploitation in the wild at the time of analysis.

Remediation

Upgrade LXD to a patched version released after July 2026. Verify the exact version number against Canonical's security advisory, as this summary was prepared based on vulnerability publication details. In the interim, restrict can_create_storage_volumes permissions to trusted users only, and monitor LXD daemon logs for crash patterns. Consider segmenting LXD hosts to limit exposure from compromised container-user accounts. No workarounds exist short of removing the permission from untrusted accounts.

Patch guidance

Check Canonical's LXD security advisories for the specific patch version that resolves this issue. Patches are expected in both the 6.x and 5.x branches. Apply updates via your distribution's package manager (apt, snap, or direct binary replacement depending on your LXD installation method). Test patches in a staging environment first, as LXD version upgrades can affect running containers and virtual machines. Plan maintenance windows to minimize service disruption. Verify the patch is applied by checking the output of 'lxc --version' and confirming the version is newer than 6.8 or 5.21.

Detection guidance

Monitor LXD daemon logs (typically in /var/log/lxd/ or journalctl) for segmentation faults or null-pointer exceptions in CreateCustomVolumeFromBackup. Watch for repeated crash cycles coinciding with backup file uploads. Audit which users and service accounts hold can_create_storage_volumes permissions using 'lxc config show' or equivalent API calls. Collect and analyze backup tarballs uploaded to the system; malformed snapshots missing expires_at fields are suspicious. Consider enabling enhanced logging in LXD (via core.debug or core.log_level) during the patch window to improve forensic visibility.

Why prioritize this

This is a MEDIUM-severity denial-of-service vulnerability affecting active LXD versions in widespread use. While it requires authentication, the low barrier to exploitation and high impact on availability make it a priority for affected organizations. The vulnerability is likely to be researched and exploited opportunistically once patches are available and the delta is clear. Organizations running multi-tenant LXD clusters or relying on LXD for production workloads should prioritize patching within 30 days.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a vulnerability with no confidentiality or integrity impact (C:N/I:N) but high availability impact (A:H). The requirement for authenticated access (PR:L) and low attack complexity (AC:L) place it in the middle severity range. Network-accessible LXD instances increase risk; air-gapped or internally-only LXD systems are at lower risk. The absence of KEV listing suggests active exploitation is not yet widespread, reducing urgency but not eliminating it.

Frequently asked questions