MEDIUM 6.5 GitHub
CVE-2026-9639
LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at
## Summary
(sibling-field variant of CVE-2026-40197 fix 05bc272)
`(*lxdBackend).CreateCustomVolumeFromBackup` in [`lxd/storage/backend_lxd.go`](https://github.com/canonical/lxd/blob/05bc272/lxd/storage/backend_lxd.go) contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with `EntitlementCanCreateStorageVolumes` permission on any project can crash the `lxd` daemon by uploading a backup t
Affected Products
- go/github.com/canonical/lxd < 0.0.0-20260622081844-85f897013ccd
References
- https://github.com/advisories/GHSA-j93m-3j9p-m5m8
- https://github.com/canonical/lxd/security/advisories/GHSA-j93m-3j9p-m5m8
- https://nvd.nist.gov/vuln/detail/CVE-2026-9639
- https://github.com/canonical/lxd/pull/18320
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-11-06 via GitHub. Affected: go/github.com/canonical/lxd < 0.0.0-20260622081844-85f897013ccd.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.