CVE-2026-9639 Overview
CVE-2026-9639 is a nil-pointer dereference vulnerability in the CreateCustomVolumeFromBackup function of Canonical LXD. The flaw affects LXD versions up to 6.8 and 5.21 running on Linux. An authenticated user holding the can_create_storage_volumes permission can trigger a denial of service by supplying a specially crafted custom-volume backup tarball. The malicious tarball omits the expires_at snapshot field, which causes LXD to dereference a nil pointer and crash. The issue is tracked under [CWE-476] (NULL Pointer Dereference).
Critical Impact
Authenticated users with storage volume creation rights can crash the LXD daemon, disrupting all managed containers and virtual machines on the host.
Affected Products
- Canonical LXD up to version 6.8
- Canonical LXD 5.21 branch
- Linux kernel platforms running affected LXD versions
Discovery Timeline
- 2026-06-26 - CVE-2026-9639 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-9639
Vulnerability Analysis
The vulnerability resides in the CreateCustomVolumeFromBackup code path within Canonical LXD. LXD accepts backup tarballs to restore custom storage volumes and their snapshots. During restoration, LXD parses metadata that describes each snapshot, including an expires_at timestamp field. When the backup tarball omits expires_at for a snapshot, LXD does not validate the field before dereferencing it. The resulting nil-pointer dereference terminates the daemon process. Because LXD manages the lifecycle of containers and virtual machines on the host, a crash affects all workloads governed by the daemon.
Root Cause
The root cause is missing input validation on deserialized backup metadata. The restore routine assumes every snapshot entry contains a non-nil expires_at field. When an attacker supplies a tarball that violates this assumption, the pointer resolves to nil and Go raises a runtime panic. The upstream fixes in LXD Pull Request #18320 and LXD Pull Request #18390 add explicit nil checks before the metadata is consumed.
Attack Vector
Exploitation requires an authenticated LXD account with the can_create_storage_volumes permission. The attacker crafts a custom-volume backup tarball where at least one snapshot entry lacks the expires_at field. Uploading and importing the tarball through the standard volume-restore API triggers the panic. No user interaction is required, and the attack succeeds over the network against any reachable LXD API endpoint. The impact is limited to availability. Confidentiality and integrity are not affected.
The vulnerability manifests during unmarshaling of backup metadata. See the GitHub Security Advisory GHSA-j93m-3j9p-m5m8 for technical details.
Detection Methods for CVE-2026-9639
Indicators of Compromise
- Unexpected termination or restart of the lxd daemon process on Linux hosts.
- Panic traces in journalctl -u snap.lxd.daemon or systemd logs referencing CreateCustomVolumeFromBackup or nil pointer dereference.
- API audit records showing custom volume backup imports immediately preceding daemon crashes.
Detection Strategies
- Monitor LXD API logs for POST /1.0/storage-pools/{pool}/volumes/custom/backups calls followed by daemon exits.
- Alert on repeated backup-import failures from the same authenticated principal.
- Baseline LXD daemon uptime and flag statistically significant restart events.
Monitoring Recommendations
- Ship LXD daemon logs and Linux systemd journal entries to a central logging platform for correlation.
- Track use of the can_create_storage_volumes permission across LXD projects and identities.
- Correlate volume-restore activity with container and VM availability metrics to identify DoS attempts.
How to Mitigate CVE-2026-9639
Immediate Actions Required
- Upgrade LXD to a patched release beyond versions 6.8 and 5.21 as published by Canonical.
- Audit which identities hold the can_create_storage_volumes permission and revoke where not required.
- Restrict network exposure of the LXD API to trusted management networks only.
Patch Information
Canonical merged fixes in LXD Pull Request #18320 and LXD Pull Request #18390. Both changes add validation for the expires_at field before the pointer is dereferenced. Refer to the GitHub Security Advisory GHSA-j93m-3j9p-m5m8 for supported patched versions.
Workarounds
- Temporarily remove the can_create_storage_volumes permission from non-administrative identities until patches are applied.
- Disable custom volume backup imports from untrusted sources through project-level restrictions.
- Deploy the LXD daemon under a supervisor that alerts operators on unexpected restarts to reduce mean time to recovery.
# Verify installed LXD version and update on Ubuntu/snap-based deployments
lxd --version
sudo snap refresh lxd
# Review identities with volume creation rights
lxc auth identity list
lxc auth group show <group-name>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
