What is the CVSS score of CVE-2026-9639?

CVE-2026-9639 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-9639?

Yes, a patch is available for CVE-2026-9639. Update the affected software to the latest version immediately.

LXD CVE-2026-9639

EUVD-2026-39789 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-06-26 canonical

Denial Of Service Null Pointer Dereference Lxd

6.5

CVSS 3.1 · Vendor: canonical

Severity by source

Vendor (canonical) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-accessible LXD API, low complexity; PR:L because can_create_storage_volumes is required; crash yields A:H with no data exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (canonical).

CVSS VectorVendor: canonical

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 26, 2026 - 16:21 vuln.today

Analysis Generated

Jun 26, 2026 - 16:21 vuln.today

CVE Published

Jun 26, 2026 - 15:39 cve.org

MEDIUM 6.5

DescriptionCVE.org

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.

AnalysisAI

Nil-pointer dereference in LXD's CreateCustomVolumeFromBackup function allows an authenticated user with can_create_storage_volumes permissions to crash the LXD daemon via a crafted backup tarball, affecting all containers running on the host. Versions up to 6.8 (current branch) and 5.21 (LTS branch) on Linux are vulnerable. No public exploit or CISA KEV listing exists at time of analysis, but upstream fix commits are available from Canonical.

Technical ContextAI

LXD is Canonical's open-source Linux container and virtual machine hypervisor, primarily deployed on Ubuntu. The flaw resides in lxd/storage/backend_lxd.go within the CreateCustomVolumeFromBackup function. During custom volume restoration from a backup tarball, the code iterates over snapshot entries and unconditionally dereferences the ExpiresAt pointer field (*snapshot.ExpiresAt) when calling VolumeDBCreate. If a crafted tarball omits the expires_at field for any snapshot, the pointer is nil and dereferencing it triggers a fatal nil-pointer dereference (CWE-476), crashing the LXD daemon process. The patch (PR #18320) introduces an explicit nil guard: if snapshot.ExpiresAt != nil, the value is used; otherwise a zero-value time.Time is passed. CPE cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:* covers the affected product across all listed versions.

RemediationAI

Upstream fix commits are available in Canonical's GitHub repository via pull requests #18320 (https://github.com/canonical/lxd/pull/18320) and #18390 (https://github.com/canonical/lxd/pull/18390). Exact patched release versions are not independently confirmed from available data - monitor the vendor advisory at https://github.com/canonical/lxd/security/advisories/GHSA-j93m-3j9p-m5m8 for official release tags and apply the update as soon as a patched version is published. As a compensating control prior to patching, restrict the can_create_storage_volumes permission to only fully trusted administrators using LXD's fine-grained authorization system; note this prevents all non-admin users from creating volumes from backups, which may impact legitimate workflows. Additionally, restrict LXD API network exposure to trusted network segments where feasible.