LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at

🗓️ 06 Nov 2026 19:37:14Reported by GitHub Advisory DatabaseType

Authenticated users can crash the lxd daemon via nil-pointer dereference in CreateCustomVolumeFromBackup.

Reporter	Title	Published	Views	Family All 56
attackerkb	CVE-2026-40197	6 May 202620:36	–	attackerkb
attackerkb	CVE-2026-9639	26 Jun 202615:39	–	attackerkb
AlpineLinux	CVE-2026-40197	6 May 202620:36	–	alpinelinux
BDU FSTEC	server daemon incusd in DoS	14 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-40197	5 May 202601:30	–	circl
CNNVD	Incus code issue vulnerabilities	6 May 202600:00	–	cnnvd
CVE	CVE-2026-40197	6 May 202620:36	–	cve
CVE	CVE-2026-9639	26 Jun 202615:39	–	cve
Cvelist	CVE-2026-40197 Incus nil-pointer dereference in custom volume import allows denial of service	6 May 202620:36	–	cvelist
Cvelist	CVE-2026-9639 Authenticated Denial of Service via Malicious Backup Tarball in LXD	26 Jun 202615:39	–	cvelist

Vulners

Node

canonical lxdRange<0.0.0-20260622081844-85f897013ccdgo

Source	Link
github	www.github.com/canonical/lxd/security/advisories/GHSA-j93m-3j9p-m5m8
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-9639
github	www.github.com/canonical/lxd/pull/18320
github	www.github.com/canonical/lxd/pull/18390
github	www.github.com/canonical/lxd/commit/05bc2729e99707a766d5c4705167a3322c9ef424
github	www.github.com/canonical/lxd/commit/c7cdfadb6044dfeaac592dc225978b4125ee23fe
github	www.github.com/canonical/lxd/commit/d15520809e6e2ac2af0c6354dfb7be5854b0e859
github	www.github.com/CVEProject/cvelistV5/blob/main/cves/2026/9xxx/CVE-2026-9639.json
github	www.github.com/canonical/lxd/blob/lxd-5.0.7/lxd/storage/backend_lxd.go
github	www.github.com/canonical/lxd/releases/tag/lxd-5.21.5

06 Nov 2026 19:37Current

7High risk

Vulners AI Score7

CVSS 3.16.5

CVSS 47.1

EPSS0.00548

SSVC