Description
Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Canonical | LXD | 5.21.0 – < 5.21.5, 6.0 – < 6.9 | 5.21.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | lxd | 5.0.2+git20231211.1364ae4-9+deb13u7 | — |
| Debian 12 | lxd | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/canonical/lxd | < 0.0.0-20260622081844-85f897013ccd | 0.0.0-20260622081844-85f897013ccd | GHSA-j93m-3j9p-m5m8 |
References
- https://github.com/canonical/lxd/security/advisories/GHSA-j93m-3j9p-m5m8 vdb-entry vendor-advisory
- https://github.com/canonical/lxd/pull/18320 patch
- https://github.com/canonical/lxd/pull/18390 patch