Vulnerability · Published Jun 26, 2026 · Assigned by canonical
CVE-2026-9639Authenticated Denial of Service via Malicious Backup Tarball in LXD
Medium 6.5
In plain English
A medium-severity null pointer dereference in LXD from Canonical. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 53.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | lxd | no fix listed | DEBIAN-CVE-2026-9639 |
| Debian:13 | lxd | 5.0.2+git20231211.1364ae4-9+deb13u7 | DEBIAN-CVE-2026-9639 |
| Go | github.com/canonical/lxd | 0.0.0-20260622081844-85f897013ccd | GHSA-j93m-3j9p-m5m8 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H