CVE-2026-9639: Authenticated Denial of Service via Malicious Backup Tarball in LXD
Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with cancreatestoragevolumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expiresat snapshot field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LXDto a version that resolves this vulnerability.Fixed in 5.21.5 - Upgrade
Upgrade
LXDto a version that resolves this vulnerability.Fixed in 6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9639?
The severity of CVE-2026-9639 is medium with a score of 6.5.
How do I fix CVE-2026-9639?
To fix CVE-2026-9639, upgrade to LXD version 6.9 or later.
What is the impact of CVE-2026-9639?
CVE-2026-9639 allows authenticated users to cause a denial of service through a malicious backup tarball.
Who is affected by CVE-2026-9639?
Authenticated users with 'can_create_storage_volumes' permissions on LXD installations up to version 6.8 and 5.21 are affected by CVE-2026-9639.
What causes the vulnerability in CVE-2026-9639?
CVE-2026-9639 is caused by a nil-pointer dereference in the CreateCustomVolumeFromBackup function.