Is CVE-2026-9639 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9639 being exploited in the wild.

How severe is CVE-2026-9639?

Medium severity, with a CVSS score of 6.5, published 26 June 2026.

Which products and versions are affected?

Canonical LXD 5.21.0 to 5.21.4, 6.0 to 6.8; github.com/canonical/lxd (Go) < 0.0.0-20260622081844-85f897013ccd, SEMVER:introduced=0,fixed=0.0.0-20260622081844-85f897013ccd.

Is there a fix for CVE-2026-9639?

Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20260622081844-85f897013ccd or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9639 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-9639?

Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9639: Canonical LXD denial of service via nil-pointer dereference in volume backup import

Q: Is there a fix for CVE-2026-9639?

Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20260622081844-85f897013ccd or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-9639 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2026-9639?

Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9639 · Severity: medium · CVSS 6.5 · Published 2026-06-26

LXD is a system container and virtual machine manager used to run and manage Linux environments. A vulnerability in how it handles storage volume backups allows an authorized user to crash the entire LXD management service. By uploading a specially crafted backup file that is missing specific expiration data, an attacker can cause a denial of service, stopping all container and VM management operations on the host until the service is manually restarted.

Technologies: Canonical LXD, github.com/canonical/lxd (Go). Vendors: Canonical, Go.

Quick answers

Is CVE-2026-9639 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9639 being exploited in the wild.
How severe is CVE-2026-9639?: Medium severity, with a CVSS score of 6.5, published 26 June 2026.
Which products and versions are affected?: Canonical LXD 5.21.0 to 5.21.4, 6.0 to 6.8; github.com/canonical/lxd (Go) < 0.0.0-20260622081844-85f897013ccd, SEMVER:introduced=0,fixed=0.0.0-20260622081844-85f897013ccd.
Is there a fix for CVE-2026-9639?: Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20260622081844-85f897013ccd or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9639 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-9639?: Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/canonical/lxd (Go): upgrade to 0.0.0-20260622081844-85f897013ccd or later
```
go get github.com/canonical/lxd@v0.0.0-20260622081844-85f897013ccd
```

Technical details

A NULL pointer dereference (CWE-476) exists in `lxd/storage/backend_lxd.go` within the `CreateCustomVolumeFromBackup` function. The vulnerability is caused by an unguarded dereference of the `ExpiresAt` field in the `snapshot` struct when importing a custom-volume backup. While other parts of the codebase correctly validate this field, line 8216 fails to check if the pointer is nil before dereferencing it. An authenticated attacker with `can_create_storage_volumes` permissions can trigger a daemon panic by uploading a backup tarball containing a `backup/index.yaml` file where the `expires_at` field is omitted for a snapshot. This results in a persistent denial of service as the Go runtime terminates the entire process. The issue is patched in versions 5.21.5 and 6.9.

Affected products

Canonical LXD 5.21.0 to 5.21.4, 6.0 to 6.8

Identifiers

CVE-2026-9639
GHSA-j93m-3j9p-m5m8

Timeline

2026-05-22: patched: Initial fix merged into main branch
2026-06-03: patched: Fix backported to 5.21 LTS branch
2026-06-26: advisory: Security advisory and CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.