Skip to content
OpenAdvisories
Medium USN-8826-1 2 CVEs

lxc vulnerabilities

Published Sep 28, 2026 · Updated Sep 28, 2026

Ecosystem: Ubuntu

Summary

Maher Azzouzi discovered that LXC did not correctly handle logging
certain failure messages. An attacker could possibly use this issue
to leak sensitive information. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2022-47952)

Sam Sanoop discovered that LXC did not correctly handle certain forms
of user authorization. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-39402)

Fixed packages 6

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS lxc 2.0.11-0ubuntu1~16.04.3+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS lxc 3.0.3-0ubuntu1~18.04.3+esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS lxc 1:4.0.12-0ubuntu1~20.04.1+esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS lxc 1:5.0.0~git2209-g5a7b9ce67-0ubuntu1.1+esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS lxc 1:5.0.3-2ubuntu7.3+esm1
Ubuntu · Pro 26.04 LTS Pro:26.04:LTS lxc 1:6.0.6-1ubuntu1+esm1

Vulnerabilities 2

  • Medium 4.3
    CVE-2026-39402

    lxc lxc-user-nic insufficient ownership validation allows cross-tenant OVS port deletion

    lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw in the find_line() function that allows an unprivileged user to delete OVS-attached network interfaces belonging to other users. When lxc-user-nic delet…

    lxc lxc lxc lxc Debian Ubuntu
  • Low 3.3
    CVE-2022-47952 Public exploit

    lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists,…

    lxc lxc lxc Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2022-47952
  • report
    https://ubuntu.com/security/CVE-2026-39402