CVE-2026-9639 · GHSA-j93m-3j9p-m5m8

LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at

Risk score: 58/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.5%
Published: 26 Jun 2026

Open in the live forecast Today's forecast

What to know

What it is: Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.
Affected: github.com/canonical/lxd (go) < 0.0.0-20260622081844-85f897013ccd
Fix: Upgrade github.com/canonical/lxd to 0.0.0-20260622081844-85f897013ccd or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/canonical/lxd: Amber, patch this week. A vulnerability in Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request. This could enable an attacker to access sensitive data or disrupt the system.

The flaws

CVE-2026-9639: LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at (CVSS 6.5 · EPSS 1%)
CVE-2026-12411: Lxd allows Cross-guest volume hijack via DevLXD device patch (CVSS 9.6 · EPSS 0%)
CVE-2026-28385: LXD: SSRF via image import from URL allows internal network probing by authenticated users (CVSS 5.0 · EPSS 0%)

The fix

Fix: Upgrade to version 0.0.0-20260626085133-7cb96ac80a6d or later

Who is exposed: {'product': 'lxd', 'package': 'github.com/canonical/lxd', 'version': '>= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d'}

Where it stands

Public proof of concept

Connects to

Same weakness: Null pointer dereference (CWE-476). 152 other warnings in 30 days

Why it is Yellow

CVSS 6.5 medium
Public exploit or proof of concept referenced
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/canonical/lxd	go	< 0.0.0-20260622081844-85f897013ccd	0.0.0-20260622081844-85f897013ccd

References

Original description

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.

Last activity 6 Nov 2026. Patch Forecast updates every hour.