CVE-2026-9639: Authenticated Denial of Service via Nil-Pointer Dereference in Canonical LXD Custom Volume Backup Import

Vulnerability ID: CVE-2026-9639
CVSS Score: 6.5
Published: 2026-11-06

CVE-2026-9639 (GHSA-j93m-3j9p-m5m8) is a null pointer dereference vulnerability in Canonical LXD affecting versions 5.0.0 through 5.21.4 and 6.0 through 6.8. The flaw resides in the (*lxdBackend).CreateCustomVolumeFromBackup method within lxd/storage/backend_lxd.go. An authenticated attacker with the can_create_storage_volumes permission can upload a crafted custom volume backup tarball that omits the expires_at field on a snapshot entry, triggering an unhandled SIGSEGV panic and terminating the LXD daemon.

TL;DR

An unguarded pointer dereference on snapshot expiration timestamps during custom storage volume backup restoration allows authenticated users with volume creation privileges to crash the Canonical LXD daemon via a malformed backup archive.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability Class: CWE-476: NULL Pointer Dereference
• CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
• Affected Component: (*lxdBackend).CreateCustomVolumeFromBackup in lxd/storage/backend_lxd.go
• Attack Vector: Authenticated HTTP POST to /1.0/storage-pools/{pool}/volumes/custom
• Required Privileges: can_create_storage_volumes (EntitlementCanCreateStorageVolumes)
• Primary Impact: Unhandled SIGSEGV daemon crash (Denial of Service)
• Exploit Status: Public Proof-of-Concept (PoC) Available
• Patched Versions: LXD 6.9 and LXD 5.21.5

Affected Systems

• Canonical LXD
• LXD: >= 6.0, < 6.9 (Fixed in: 6.9)
• LXD: >= 5.0.0, < 5.21.5 (Fixed in: 5.21.5)

Code Analysis

Commit: c7cdfad

Primary patch on main branch (PR #18320) checking if snapshot.ExpiresAt is non-nil before dereferencing in CreateCustomVolumeFromBackup.

--- a/lxd/storage/backend_lxd.go
+++ b/lxd/storage/backend_lxd.go
@@ -8213,7 +8213,12 @@ func (b *lxdBackend) CreateCustomVolumeFromBackup(ctx context.Context, srcBackup

        // Validate config and create database entry for new storage volume.
        // Strip unsupported config keys (in case the export was made from a different type of storage pool).
-       err = VolumeDBCreate(b, srcBackup.Project, fullSnapName, snapshot.Description, snapVol.Type(), true, snapVol.Config(), snapshot.CreatedAt, *snapshot.ExpiresAt, snapVol.ContentType(), true, true)
+       var snapExpiryDate time.Time
+       if snapshot.ExpiresAt != nil {
+           snapExpiryDate = *snapshot.ExpiresAt
+       }
+
+       err = VolumeDBCreate(b, srcBackup.Project, fullSnapName, snapshot.Description, snapVol.Type(), true, snapVol.Config(), snapshot.CreatedAt, snapExpiryDate, snapVol.ContentType(), true, true)
        if err != nil {
            return err
        }

Commit: d155208

Backport patch for the LXD 5.21 LTS branch (PR #18390).

Commit: 05bc272

Prior fix for CVE-2026-40197 ('Validate snapshots from backup.yaml are non-nil') that left the adjacent *snapshot.ExpiresAt dereference unguarded.

Exploit Details

• GitHub Security Advisory: Public Proof of Concept (PoC) backup/index.yaml payload and curl reproduction steps published in the official vendor advisory.

Mitigation Strategies

• Upgrade Canonical LXD to patched releases (6.9+ for the feature branch, 5.21.5+ for the LTS branch).
• Restrict the can_create_storage_volumes (EntitlementCanCreateStorageVolumes) permission to fully trusted administrative identities.
• Restrict network exposure of the LXD HTTPS REST API (TCP port 8443) to trusted management networks.
• Monitor LXD daemon logs for runtime panics and SIGSEGV signals in CreateCustomVolumeFromBackup.

Remediation Steps:

1. Identify the currently installed LXD version using 'lxd --version' or 'snap list lxd'.
2. If running LXD 6.0 through 6.8, upgrade to LXD 6.9 or later.
3. If running LXD 5.0.0 through 5.21.4, upgrade to LXD 5.21.5 or later.
4. Audit OpenFGA / RBAC role bindings and local 'lxd' unix group memberships to remove unnecessary volume creation entitlements.

References

• GitHub Security Advisory GHSA-j93m-3j9p-m5m8
• National Vulnerability Database (NVD) - CVE-2026-9639
• CVE.org Record - CVE-2026-9639
• Canonical LXD Pull Request #18320 (Main Branch Fix)
• Canonical LXD Pull Request #18390 (5.21 LTS Backport)
• Fix Commit c7cdfadb6044dfeaac592dc225978b4125ee23fe
• Backport Commit d15520809e6e2ac2af0c6354dfb7be5854b0e859
• Prior Commit 05bc2729e99707a766d5c4705167a3322c9ef424 (CVE-2026-40197 Fix)
• Canonical LXD 6.9 Release Notes
• Canonical LXD 5.21.5 Release Notes
• CVEListV5 JSON Record for CVE-2026-9639

Read the full report for CVE-2026-9639 on our website for more details including interactive diagrams and full exploit analysis.