CVE-2026-63298: LXD NVIDIA Configuration RCE Vulnerability

CVE-2026-63298 Overview

CVE-2026-63298 is a command injection vulnerability in Canonical LXD's NVIDIA instance configuration handling. Authenticated attackers can inject arbitrary configuration directives by embedding newline characters within the nvidia.driver.capabilities or nvidia.require.* configuration values. The injection manipulates the generated lxc.conf file, enabling arbitrary code execution on the host with the privileges of the LXD daemon. The vulnerability is tracked under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
An authenticated LXD user can escape container boundaries and execute code as the LXD daemon on the host, resulting in full host compromise.

Affected Products

Canonical LXD (NVIDIA instance configuration handling)
LXD deployments using NVIDIA GPU passthrough
Multi-tenant LXD environments with delegated instance configuration

Discovery Timeline

2026-08-12 - CVE-2026-63298 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database
Advisory - Published by Canonical as GHSA-vfh7-q59q-54v2

Technical Details for CVE-2026-63298

Vulnerability Analysis

LXD generates lxc.conf configuration files from user-supplied instance settings. When constructing NVIDIA GPU passthrough directives, LXD fails to neutralize newline characters within specific configuration keys. An attacker who can set instance configuration values can therefore break out of a single directive line and inject additional lxc.* directives into the generated file.

The affected keys are nvidia.driver.capabilities and any key matching the nvidia.require.* pattern. These values are copied into the generated LXC configuration without sanitization. Because LXC configuration directives control mount points, hooks, and pre-start commands, the injected content can trigger execution paths under the LXD daemon.

The LXD daemon typically runs with root privileges to manage containers, mount filesystems, and configure networking. Injected directives inherit those privileges, so successful exploitation yields root-equivalent access on the host system.

Root Cause

The root cause is missing input validation on multi-line content within NVIDIA-related configuration keys. The code path that serializes instance settings into lxc.conf treats each configuration value as a single line and does not reject or escape embedded \n characters.

Attack Vector

An attacker requires authenticated access to LXD with permission to modify instance configuration. Using the LXD API or lxc config set command, the attacker assigns a value containing newline characters to nvidia.driver.capabilities or a nvidia.require.* key. When LXD regenerates the container configuration, the injected directives are written into lxc.conf and interpreted by LXC on the next container start.

Refer to the Canonical LXD Security Advisory GHSA-vfh7-q59q-54v2 for full technical detail.

Detection Methods for CVE-2026-63298

Indicators of Compromise

Instance configuration values for nvidia.driver.capabilities or nvidia.require.* that contain embedded newline characters or unexpected lxc. directive prefixes
Unexpected entries in generated lxc.conf files such as lxc.hook.pre-start, lxc.mount.entry, or lxc.init.cmd that were not defined by an administrator
LXD daemon spawning unexpected child processes or shell interpreters at container start

Detection Strategies

Audit all LXD instance configurations for the nvidia.driver.capabilities and nvidia.require.* keys and flag any value containing control characters
Compare rendered lxc.conf files against expected templates for LXD-managed instances
Monitor LXD API calls that set NVIDIA configuration keys, correlating with the identity of the requester

Monitoring Recommendations

Enable audit logging for the LXD REST API and record all PATCH and PUT requests against instance endpoints
Alert on process creation events where the parent process is lxd or lxc-start and the child is an unexpected interpreter such as bash, sh, or python
Track integrity of lxc.conf files under /var/lib/lxd/containers/*/ and /var/snap/lxd/common/lxd/containers/*/

How to Mitigate CVE-2026-63298

Immediate Actions Required

Upgrade LXD to the patched version identified in GHSA-vfh7-q59q-54v2
Inventory all instances with nvidia.* configuration keys and review their values for injection artifacts
Restrict LXD API access to trusted operators until patching is complete

Patch Information

Canonical has published the fix through the LXD security advisory GHSA-vfh7-q59q-54v2. Apply the vendor-supplied update via snap refresh lxd or the distribution package manager and restart the LXD daemon.

Workarounds

Remove or disable the nvidia.runtime feature on instances where GPU passthrough is not required
Revoke configuration write permissions from untrusted LXD users and projects until the patch is deployed
Enforce validation of NVIDIA configuration values through admission controls or wrapper tooling that rejects control characters

bash

# Update LXD via snap and restart the daemon
sudo snap refresh lxd
sudo systemctl restart snap.lxd.daemon

# Audit instances for suspicious NVIDIA configuration values
for c in $(lxc list -c n --format csv); do
  lxc config get "$c" nvidia.driver.capabilities | \
    grep -q $'\n' && echo "Suspicious value in $c"
done