CVE-2026-63298
LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration
An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration
An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
- Record
CVE-2026-63298- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2026-57511
An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
- Record
EUVD-2026-57511- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
- Record
CVE-2026-63298- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration
An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
- Record
CVE-2026-63298- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-63298
An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
- Record
DEBIAN-CVE-2026-63298- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-63298
An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
- Record
UBUNTU-CVE-2026-63298- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21788-1 No score
Security update for lxd
This update for lxd fixes the following issues:
Changes in lxd:
-
update to 5.21.6:
- bsc#1274937, CVE-2026-63293, bsc#1274936, CVE-2026-62420, bsc#1274954, CVE-2026-63295, bsc#1274963, CVE-2026-63297, bsc#1274961, CVE-2026-63296, bsc#1275085, CVE-2026-63299, bsc#1275084, CVE-2026-63298, bsc#1275090, CVE-2026-66898
- https://canonical.com/lxd/docs/latest/reference/release- notes/5.21/release-notes-5.21.6/
- https://canonical.com/lxd/docs/latest/reference/release- notes/5.21/release-notes-5.21.5/
- https://discourse.ubuntu.com/t/lxd-5-21-4-lts-has-been- released/66602
- https://discourse.ubuntu.com/t/lxd-5-21-3-lts-has-been- released/53768
- https://discourse.ubuntu.com/t/lxd-5-21-2-has-been- released/46443
-
Migrate to single LXD/Incus OVMF handling (lxd-ovmf-setup):
- Allow aarch64 arch_vm_support
- Remove OVMF symlinks
- Require the new lxd-ovmf-setup packages
- Record
openSUSE-SU-2026:21788-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lxdDebian:12 |
All versions, plus listed versions 5.0.2+git20231211.1364ae4-15.0.2+git20231211.1364ae4-25.0.2+git20231211.1364ae4-35.0.2+git20231211.1364ae4-45.0.2+git20231211.1364ae4-5 Show 12 moreShow less5.0.2+git20231211.1364ae4-65.0.2+git20231211.1364ae4-75.0.2+git20231211.1364ae4-85.0.2+git20231211.1364ae4-95.0.2-55.0.2-5+deb12u15.0.2-5+deb12u25.0.2-5+deb12u35.0.2-5+deb12u45.0.2-5+deb12u55.0.2-5+deb12u65.0.2-6 |
None known |
lxdDebian:13 |
All versions, plus listed versions 5.0.2+git20231211.1364ae4-95.0.2+git20231211.1364ae4-9+deb13u15.0.2+git20231211.1364ae4-9+deb13u25.0.2+git20231211.1364ae4-9+deb13u35.0.2+git20231211.1364ae4-9+deb13u45.0.2+git20231211.1364ae4-9+deb13u55.0.2+git20231211.1364ae4-9+deb13u65.0.2+git20231211.1364ae4-9+deb13u7 |
None known |
lxdUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.20-0ubuntu40.21-0ubuntu30.21-0ubuntu50.22-0ubuntu10.22-0ubuntu2 Show 45 moreShow less0.23-0ubuntu10.23-0ubuntu20.23-0ubuntu30.24-0ubuntu20.24-0ubuntu30.24-0ubuntu40.25-0ubuntu10.26-0ubuntu20.26-0ubuntu30.27-0ubuntu10.27-0ubuntu22.0.0~beta1-0ubuntu32.0.0~beta1-0ubuntu42.0.0~beta2-0ubuntu12.0.0~beta2-0ubuntu22.0.0~beta3-0ubuntu12.0.0~beta3-0ubuntu22.0.0~beta3-0ubuntu32.0.0~beta3-0ubuntu42.0.0~beta4-0ubuntu12.0.0~beta4-0ubuntu22.0.0~beta4-0ubuntu32.0.0~beta4-0ubuntu42.0.0~beta4-0ubuntu52.0.0~beta4-0ubuntu62.0.0~beta4-0ubuntu72.0.0~rc1-0ubuntu12.0.0~rc1-0ubuntu22.0.0~rc1-0ubuntu32.0.0~rc2-0ubuntu22.0.0~rc2-0ubuntu32.0.0~rc3-0ubuntu12.0.0~rc3-0ubuntu22.0.0~rc3-0ubuntu32.0.0~rc3-0ubuntu42.0.0~rc4-0ubuntu12.0.0~rc5-0ubuntu12.0.0~rc6-0ubuntu12.0.0~rc6-0ubuntu22.0.0~rc7-0ubuntu12.0.0~rc7-0ubuntu22.0.0~rc8-0ubuntu12.0.0~rc8-0ubuntu22.0.0~rc8-0ubuntu32.0.0~rc8-0ubuntu5 |
None known |
lxdUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.18-0ubuntu62.19-0ubuntu12.20-0ubuntu32.20-0ubuntu42.21-0ubuntu1 Show 18 moreShow less2.21-0ubuntu22.21-0ubuntu32.21-0ubuntu43.0.0~beta2-0ubuntu33.0.0~beta3-0ubuntu33.0.0~beta5-0ubuntu23.0.0~beta7-0ubuntu13.0.0-0ubuntu13.0.0-0ubuntu23.0.0-0ubuntu33.0.0-0ubuntu43.0.1-0ubuntu1~18.04.13.0.2-0ubuntu1~18.04.13.0.3-0ubuntu1~18.04.13.0.3-0ubuntu1~18.04.23.0.3-0ubuntu1~18.04.2+esm13.0.3-0ubuntu1~18.04.2+esm23.0.3-0ubuntu1~18.04.2+esm3 |
None known |
lxdUbuntu:20.04:LTS |
All versions, plus listed versions 1:0.71:0.81:0.91:0.10 |
None known |
lxdopenSUSE:Leap 16.0 |
before 5.21.6-bp160.1.1 | 5.21.6-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-63298 is a high vulnerability (CVSS 8.7) in Canonical Lxd, published August 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 52nd percentile. Fixed in lxd 5.21.6-bp160.1.1.
References
github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2
nvd.nist.gov/vuln/detail/CVE-2026-63298
security-tracker.debian.org/tracker/CVE-2026-63298
ubuntu.com/security/CVE-2026-63298
Show 19 moreShow less
cve.org/CVERecord?id=CVE-2026-63298
bugzilla.suse.com/1223794
suse.com/security/cve/CVE-2023-46565
Left out here: 26 versions. The JSON record has them.