# CVE-2026-9639: Canonical LXD denial of service via nil-pointer dereference in volume backup import

Source: https://junglewise.ai/threats/cve-2026-9639-canonical-lxd-denial-of-service-via-nil-pointer-dereference-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-9639 · Severity: medium · CVSS 6.5 · Published 2026-06-26

LXD is a system container and virtual machine manager used to run and manage Linux environments. A vulnerability in how it handles storage volume backups allows an authorized user to crash the entire LXD management service. By uploading a specially crafted backup file that is missing specific expiration data, an attacker can cause a denial of service, stopping all container and VM management operations on the host until the service is manually restarted.

Technologies: [Canonical LXD](https://junglewise.ai/threats/technologies/lxd), [github.com/canonical/lxd (Go)](https://junglewise.ai/threats/technologies/github-com-canonical-lxd). Vendors: [Canonical](https://junglewise.ai/threats/vendors/canonical), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-9639 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9639 being exploited in the wild.

**How severe is CVE-2026-9639?** Medium severity, with a CVSS score of 6.5, published 26 June 2026.

**Which products and versions are affected?** Canonical LXD 5.21.0 to 5.21.4, 6.0 to 6.8; github.com/canonical/lxd (Go) < 0.0.0-20260622081844-85f897013ccd, SEMVER:introduced=0,fixed=0.0.0-20260622081844-85f897013ccd.

**Is there a fix for CVE-2026-9639?** Yes. github.com/canonical/lxd (Go): upgrade to 0.0.0-20260622081844-85f897013ccd or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9639 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-9639?** Check whether you run Canonical LXD or github.com/canonical/lxd (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/canonical/lxd (Go): upgrade to 0.0.0-20260622081844-85f897013ccd or later

  ```sh
  go get github.com/canonical/lxd@v0.0.0-20260622081844-85f897013ccd
  ```


## Technical details

A NULL pointer dereference (CWE-476) exists in `lxd/storage/backend_lxd.go` within the `CreateCustomVolumeFromBackup` function. The vulnerability is caused by an unguarded dereference of the `ExpiresAt` field in the `snapshot` struct when importing a custom-volume backup. While other parts of the codebase correctly validate this field, line 8216 fails to check if the pointer is nil before dereferencing it. An authenticated attacker with `can_create_storage_volumes` permissions can trigger a daemon panic by uploading a backup tarball containing a `backup/index.yaml` file where the `expires_at` field is omitted for a snapshot. This results in a persistent denial of service as the Go runtime terminates the entire process. The issue is patched in versions 5.21.5 and 6.9.

## Affected products

- Canonical LXD 5.21.0 to 5.21.4, 6.0 to 6.8

## Identifiers

- CVE-2026-9639
- GHSA-j93m-3j9p-m5m8

## Timeline

- 2026-05-22: patched: Initial fix merged into main branch
- 2026-06-03: patched: Fix backported to 5.21 LTS branch
- 2026-06-26: advisory: Security advisory and CVE published

## References

- [https://github.com/canonical/lxd/pull/18320](https://github.com/canonical/lxd/pull/18320)
- [https://github.com/canonical/lxd/pull/18390](https://github.com/canonical/lxd/pull/18390)
- [https://github.com/canonical/lxd/security/advisories/GHSA-j93m-3j9p-m5m8](https://github.com/canonical/lxd/security/advisories/GHSA-j93m-3j9p-m5m8)

## Related threats

- [LXD restricted project bypass leading to arbitrary command execution](https://junglewise.ai/threats/lxd-has-restricted-project-bypass-leading-to-arbitrary-command-9034cd45)
- [LXD project restriction bypass in custom volume copy](https://junglewise.ai/threats/lxd-has-project-restriction-bypass-for-custom-volume-copy-across-d414fa7a)
- [LXD project restriction bypass in instance copy](https://junglewise.ai/threats/lxd-has-project-restriction-bypass-in-instance-copy-across-projects-48d466e0)
- [Incus arbitrary file write via trusted image hash](https://junglewise.ai/threats/lxd-has-arbitrary-file-write-on-client-due-to-trusted-image-hash-072dacee)
- [LXD argument injection in backup compression algorithm](https://junglewise.ai/threats/lxd-has-argument-injection-in-backup-compression-algorithm-leading-to-50a60f2a)