LXD EUVD-2026-39789

Exploitation requires an authenticated LXD user account that has been explicitly granted the can_create_storage_volumes permission within LXD's authorization model. The attacker must be able to reach the LXD REST API over the network (AV:N per CVSS) and submit a backup tarball for custom volume restoration. The backup tarball must contain at least one snapshot entry where the expires_at field is absent. In standard single-operator LXD deployments this permission is held only by administrators, which substantially limits the realistic attacker population. The vulnerability cannot be triggered without this specific permission; unauthenticated users and authenticated users lacking can_create_storage_volumes are not exposed.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects a network-reachable, low-complexity attack requiring only low-privilege authenticated access, with high availability impact and no confidentiality or integrity exposure. The PR:L requirement is the primary limiter: exploitation depends on holding the can_create_storage_volumes permission, which is not granted to arbitrary authenticated users by default in standard LXD deployments. Impact is a full daemon crash, disrupting all hosted containers - a meaningful blast radius in multi-tenant or production LXD hosts. No EPSS data was provided, and no KEV listing exists, indicating this has not been observed in widespread exploitation. The combination of authenticated prerequisite, no data exfiltration, and no public POC positions this as a moderate-priority internal threat - significant for environments where multiple tenants share can_create_storage_volumes access, lower priority for single-operator deployments.

An authenticated LXD user holding the can_create_storage_volumes permission constructs a backup tarball containing a snapshot entry with the expires_at field omitted. The user submits this tarball to the LXD REST API endpoint for custom volume restoration, triggering the nil-pointer dereference in CreateCustomVolumeFromBackup. The LXD daemon crashes immediately, causing a denial of service that interrupts all containers and VMs running on the affected host until the daemon is restarted. No public POC exists at time of analysis.