CVE-2026-9639

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.

LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at

Summary

(sibling-field variant of CVE-2026-40197 fix 05bc272)

(*lxdBackend).CreateCustomVolumeFromBackup in lxd/storage/backend_lxd.go contains an unguarded *time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with EntitlementCanCreateStorageVolumes permission on any project can crash the lxd daemon by uploading a backup tarball whose volumes[0].snapshots[*].expires_at field is omitted.

This is a sibling-field variant of the CVE-2026-40197 fix (commit 05bc272, "Validate snapshots from backup.yaml are non-nil", cherry-picked from incus commit 985a1dedf / GHSA-r7w7-mmxr-47r9). That fix added if snap == nil guards at several consumer sites, but did not guard the adjacent *snapshot.ExpiresAt deref at line 8216. Every other consumer of this field in the same file already gates the deref with if … != nil (e.g. lines 1010-1011, 1274-1275, 1856-1857, 2454-2455, 5070-5071, 5527-5528). Asymmetric guard is the bug.

Vulnerable code

lxd/storage/backend_lxd.go, CreateCustomVolumeFromBackup:

// Line 8141-8150 — earliest snapshot validation pass (caches s == nil)
for i, snap := range customVol.Snapshots {
    if snap == nil {
        return fmt.Errorf("Nil custom volume snapshot definition found at index %d", i)
    }
    err = drivers.ValidVolumeName(snap.Name)
    ...
}

// Line 8196-8216 — the snapshot DB-create loop
for i, s := range customVol.Snapshots {
    if s == nil {
        return fmt.Errorf("Nil custom volume snapshot definition found at index %d", i)
    }
    snapshot := s
    ...
    // Line 8216 — UNGUARDED *time.Time deref:
    err = VolumeDBCreate(b, srcBackup.Project, fullSnapName, snapshot.Description,
        snapVol.Type(), true, snapVol.Config(), snapshot.CreatedAt,
        *snapshot.ExpiresAt,           // <-- panics when expires_at omitted in YAML
        snapVol.ContentType(), true, true)

ExpiresAt is declared *time.Time (shared/api/storage_pool_volume_snapshot.go). Every other consumer in the same file already uses the safe pattern (if … != nil { … = *… }):

| Line | Code | Guarded? | |------|------|----------| | 1010-1011 | rootVol.Snapshots[i].ExpiresAt | YES | | 1274-1275 | rootVol.Snapshots[i].ExpiresAt | YES | | 1558-1559 | srcSnap.ExpiresAt | YES | | 1856-1857 | rootVol.Snapshots[i].ExpiresAt | YES | | 2454-2455 | rootVol.Snapshots[i].ExpiresAt | YES | | 5070-5071 | customVol.Snapshots[i].ExpiresAt | YES | | 5527-5528 | srcSnap.ExpiresAt | YES | | 8216 | CreateCustomVolumeFromBackup snapshot.ExpiresAt | NO |

Reach

1. Attacker is an authenticated client (TLS cert, OIDC, or unix socket) with the EntitlementCanCreateStorageVolumes entitlement on any project. Same auth gate as CVE-2026-40197.
2. POST /1.0/storage-pools/<pool>/volumes/custom with Content-Type: application/octet-stream and X-LXD-name: <name>.
3. Body is a tar containing backup/index.yaml with type: custom, volumes[0] non-nil, and volumes[0].snapshots[0] non-nil but missing expires_at.
4. lxd/storage_volumes.go:storagePoolVolumesPost -> backup.GetInfo parses the yaml -> pool.CreateCustomVolumeFromBackup -> the validations at 8141-8150 + 8197 pass (snapshot pointer is non-nil, name is valid) -> *snapshot.ExpiresAt on line 8216 panics on the nil *time.Time.
5. The Go runtime kills the entire lxd daemon process. Repeated POSTs are a persistent denial of service.

Minimal backup/index.yaml:

name: poc-vol
backend: dir
pool: default
type: custom
optimized: false…

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.

Summary

(sibling-field variant of CVE-2026-40197 fix 05bc272)

(*lxdBackend).CreateCustomVolumeFromBackup in lxd/storage/backend_lxd.go contains an unguarded *time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with EntitlementCanCreateStorageVolumes permission on any project can crash the lxd daemon by uploading a backup tarball whose volumes[0].snapshots[*].expires_at field is omitted.

This is a sibling-field variant of the CVE-2026-40197 fix (commit 05bc272, "Validate snapshots from backup.yaml are non-nil", cherry-picked from incus commit 985a1dedf / GHSA-r7w7-mmxr-47r9). That fix added if snap == nil guards at several consumer sites, but did not guard the adjacent *snapshot.ExpiresAt deref at line 8216. Every other consumer of this field in the same file already gates the deref with if … != nil (e.g. lines 1010-1011, 1274-1275, 1856-1857, 2454-2455, 5070-5071, 5527-5528). Asymmetric guard is the bug.

Vulnerable code

lxd/storage/backend_lxd.go, CreateCustomVolumeFromBackup:

// Line 8141-8150 — earliest snapshot validation pass (caches s == nil)
for i, snap := range customVol.Snapshots {
    if snap == nil {
        return fmt.Errorf("Nil custom volume snapshot definition found at index %d", i)
    }
    err = drivers.ValidVolumeName(snap.Name)
    ...
}

// Line 8196-8216 — the snapshot DB-create loop
for i, s := range customVol.Snapshots {
    if s == nil {
        return fmt.Errorf("Nil custom volume snapshot definition found at index %d", i)
    }
    snapshot := s
    ...
    // Line 8216 — UNGUARDED *time.Time deref:
    err = VolumeDBCreate(b, srcBackup.Project, fullSnapName, snapshot.Description,
        snapVol.Type(), true, snapVol.Config(), snapshot.CreatedAt,
        *snapshot.ExpiresAt,           // <-- panics when expires_at omitted in YAML
        snapVol.ContentType(), true, true)

ExpiresAt is declared *time.Time (shared/api/storage_pool_volume_snapshot.go). Every other consumer in the same file already uses the safe pattern (if … != nil { … = *… }):

| Line | Code | Guarded? | |------|------|----------| | 1010-1011 | rootVol.Snapshots[i].ExpiresAt | YES | | 1274-1275 | rootVol.Snapshots[i].ExpiresAt | YES | | 1558-1559 | srcSnap.ExpiresAt | YES | | 1856-1857 | rootVol.Snapshots[i].ExpiresAt | YES | | 2454-2455 | rootVol.Snapshots[i].ExpiresAt | YES | | 5070-5071 | customVol.Snapshots[i].ExpiresAt | YES | | 5527-5528 | srcSnap.ExpiresAt | YES | | 8216 | CreateCustomVolumeFromBackup snapshot.ExpiresAt | NO |

Reach

1. Attacker is an authenticated client (TLS cert, OIDC, or unix socket) with the EntitlementCanCreateStorageVolumes entitlement on any project. Same auth gate as CVE-2026-40197.
2. POST /1.0/storage-pools/<pool>/volumes/custom with Content-Type: application/octet-stream and X-LXD-name: <name>.
3. Body is a tar containing backup/index.yaml with type: custom, volumes[0] non-nil, and volumes[0].snapshots[0] non-nil but missing expires_at.
4. lxd/storage_volumes.go:storagePoolVolumesPost -> backup.GetInfo parses the yaml -> pool.CreateCustomVolumeFromBackup -> the validations at 8141-8150 + 8197 pass (snapshot pointer is non-nil, name is valid) -> *snapshot.ExpiresAt on line 8216 panics on the nil *time.Time.
5. The Go runtime kills the entire lxd daemon process. Repeated POSTs are a persistent denial of service.

Minimal backup/index.yaml:

name: poc-vol
backend: dir
pool: default
type: custom
optimized: false…