CVE-2026-9639

published 2026-06-26

CVE-2026-9639: Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes…

Priority P4 31 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I N A H

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
canonical	lxd	>= 5.0.0 < 5.21.5	5.21.5
canonical	lxd	>= 5.21.0 < 5.21.5	5.21.5
canonical	lxd	>= 6.0 < 6.9	6.9

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476