CVE-2026-9639

Name of the Vulnerable Software and Affected Versions LXD versions prior to 6.9 LXD version 5.21

Description A nil-pointer dereference occurs in the CreateCustomVolumeFromBackup() function when processing a specially crafted custom-volume backup tarball that omits the expires at snapshot field. An authenticated user with can create storage volumes permissions can exploit this to cause a denial of service on Linux systems. A nil-pointer dereference is a runtime error that happens when a program attempts to use a pointer that does not point to any valid memory location.

Recommendations Update LXD to a version later than 6.8. Update LXD to a version later than 5.21.