CVE-2026-12411
Publication date 26 June 2026
Last updated 29 June 2026
Ubuntu priority
Description
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| lxd | 26.04 LTS resolute | Not in release |
| 25.10 questing | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
Notes
rodrigo-zaiden
LXD is being published as a snap since jammy. This CVE affects version >= 6.6, so it doesn't touch versions present in the archive.
Severity score breakdown
CVSS version: CVSS v3.0
Base score
8.4 · High
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N