CVE-2026-9639: Authenticated Denial of Service via Malicious Backup Tarball in LXD

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-26 · updated 2026-10-25
Weakness: CWE-476

Description

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.

Affected products

Canonical LXD: from 5.0.0 before 5.21.5; from 6.0 before 6.9 — fixed in 5.21.5, 6.9

How to fix

Upgrade to a fixed version: Canonical LXD 5.21.5, 6.9. Check the vendor advisory for mitigations.

References

https://github.com/canonical/lxd/pull/18320
https://github.com/canonical/lxd/pull/18390
https://github.com/canonical/lxd/security/advisories/GHSA-j93m-3j9p-m5m8
https://github.com/canonical/lxd/security/advisories/GHSA-j93m-3j9p-m5m8

Get alerted when CVE-2026-9639 or the next vulnerability affects your stack