Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-9639

Authenticated Denial of Service via Malicious Backup Tarball in LXD

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
canonical

Description

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Canonical LXD

Default version status: unaffected

  • 5.21.0 to < 5.21.5affected
  • 6.0 to < 6.9affected

References