Description
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Canonical | lxd | 6.6 – < 6.9 | 6.9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/canonical/lxd | >= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d | 0.0.0-20260626085133-7cb96ac80a6d | GHSA-hhf9-qw4v-72xp |
References
- Cross-guest volume hijack via DevLXD device patch vdb-entry vendor-advisory
- Security fixes from the 6.9 release patch