CVE-2026-39402: LXC Container Runtime DoS Vulnerability

CVE-2026-39402 Overview

CVE-2026-39402 is an authorization flaw [CWE-863] in the lxc-user-nic setuid helper shipped with LXC, the Linux container runtime. The vulnerability resides in the find_line() function on the delete code path. The function sets the authorization flag based on an interface name match alone, ignoring whether the ownership, type, and link fields belong to the calling user. An unprivileged user with a valid lxc-usernet policy entry can delete OpenVSwitch (OVS) attached network interfaces owned by other tenants on the same bridge. This is patched in LXC version 7.0.0.

Critical Impact
An unprivileged local attacker in a multi-tenant LXC environment using OVS bridges can repeatedly disconnect networking from another tenant's containers, causing denial of service.

Affected Products

LXC (Linux Containers) versions prior to 7.0.0
Multi-tenant deployments using lxc-user-nic with OpenVSwitch bridges
Shared infrastructure relying on lxc-usernet policy entries

Discovery Timeline

2026-05-05 - CVE-2026-39402 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-39402

Vulnerability Analysis

The lxc-user-nic binary is a setuid helper that allows unprivileged users to attach and detach network interfaces for unprivileged containers. It maintains a NIC database that records which user owns each interface, the link type, and the bridge it is attached to. When a user invokes lxc-user-nic delete, the helper scans this database to confirm that the caller is authorized to remove the requested interface.

The flaw lies in the find_line() routine that drives this scan. After the goto next label that handles entries failing earlier ownership checks, control reaches a comparison that authorizes the deletion when only the interface name matches. The ownership, type, and link fields are not re-validated at this point. No downstream code re-verifies that the matched line actually belongs to the caller.

An unprivileged attacker holding any valid lxc-usernet policy entry can therefore request deletion of an interface name owned by a different tenant. The helper executes the OVS port removal with elevated privileges. The result is repeated denial of service: one tenant can detach networking from another tenant's containers at will.

Root Cause

The root cause is incorrect authorization logic [CWE-863]. The authorization signal is set on a partial field comparison rather than a full match across owner, type, link, and name. Reachability through the goto next path also bypasses earlier ownership gates.

Attack Vector

Exploitation requires local access and a valid lxc-usernet entry. The attacker invokes lxc-user-nic delete with the target interface name. Because the impact is restricted to OVS-attached interfaces on shared bridges, the issue is scoped to multi-tenant hosts using OpenVSwitch as the LXC bridge backend. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-39402

Indicators of Compromise

Unexpected OVS port removals on shared bridges that correlate with lxc-user-nic invocations from accounts that do not own the affected interface.
Repeated container network outages affecting a single tenant while other tenants on the same host remain unaffected.
Entries in the lxc-user-nic NIC database that no longer correspond to active OVS ports.

Detection Strategies

Audit execve events for lxc-user-nic delete invocations and correlate the calling UID with the owner field of the targeted interface in the NIC database.
Monitor ovs-vsctl del-port activity initiated by the LXC helper and flag deletions where the caller does not match the recorded owner.
Track changes to the lxc-user-nic database file and alert on rapid removal patterns from a single user.

Monitoring Recommendations

Enable Linux audit rules on the lxc-user-nic binary and on the NIC database file to capture all delete operations.
Forward OVS daemon logs and host audit logs to a central analytics pipeline for cross-tenant correlation.
Alert on container network interface flaps that lack a corresponding administrative action from the owning tenant.

How to Mitigate CVE-2026-39402

Immediate Actions Required

Upgrade LXC to version 7.0.0 or later on all multi-tenant hosts using lxc-user-nic.
Inventory hosts that combine lxc-user-nic with OpenVSwitch bridges and prioritize them for patching.
Review lxc-usernet policy files and remove entries for users who do not require unprivileged NIC management.

Patch Information

The issue is fixed in LXC 7.0.0. The patch corrects the find_line() authorization logic so that ownership, type, and link fields are validated alongside the interface name before authorization is granted. Refer to the LXC GitHub Security Advisory GHSA-3m9j-g9gc-vcvq for the upstream fix.

Workarounds

Switch from OpenVSwitch bridges to standard Linux bridges for lxc-user-nic workloads until the patch is applied.
Restrict lxc-usernet to a single trusted user per host to remove the cross-tenant attack surface.
Remove the setuid bit from lxc-user-nic where unprivileged container networking is not required.

bash

# Verify installed LXC version and confirm fix
lxc-user-nic --version
# Expected output: 7.0.0 or later

# Temporary mitigation: drop setuid on the helper
sudo chmod u-s /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic