Executive brief
LXD is a system container and virtual machine manager used to run and manage Linux environments. A vulnerability in how it handles storage volume backups allows an authorized user to crash the entire LXD management service. By uploading a specially crafted backup file that is missing specific expiration data, an attacker can cause a denial of service, stopping all container and VM management operations on the host until the service is manually restarted.
Technical details
A NULL pointer dereference (CWE-476) exists in `lxd/storage/backend_lxd.go` within the `CreateCustomVolumeFromBackup` function. The vulnerability is caused by an unguarded dereference of the `ExpiresAt` field in the `snapshot` struct when importing a custom-volume backup. While other parts of the codebase correctly validate this field, line 8216 fails to check if the pointer is nil before dereferencing it. An authenticated attacker with `can_create_storage_volumes` permissions can trigger a daemon panic by uploading a backup tarball containing a `backup/index.yaml` file where the `expires_at` field is omitted for a snapshot. This results in a persistent denial of service as the Go runtime terminates the entire process. The issue is patched in versions 5.21.5 and 6.9.
Affected products
- Canonical LXD 5.21.0 to 5.21.4, 6.0 to 6.8
Timeline
- 2026-05-22: patched: Initial fix merged into main branch
- 2026-06-03: patched: Fix backported to 5.21 LTS branch
- 2026-06-26: advisory: Security advisory and CVE published