#1145041 lxd: backport CVE-2026-63300 fix to Trixie

Package:
src:lxd
Source:
src:lxd
Submitter:
Artem Dinaburg
Date:
2026-08-21 16:41:02 UTC
Severity:
normal
Tags:
#1145041#5
Date:
2026-08-21 16:38:10 UTC
From:
To:
Hello LXD maintainers,

I am requesting a backport of the upstream fix for CVE-2026-63300 to Trixie.
Restricted LXD projects let an operator delegate instance creation while
blocking settings that expose the host or protected resources. Trixie's LXD
implements a cross-project move as an internal copy, but does not apply the
target project's normal creation check to the copied configuration or devices.
The instance is not revalidated when it starts. A project-scoped HTTPS client
can therefore carry blocked `raw.lxc` host hooks, host-path devices, hardware,
or network access into the target. Those settings can execute as host root or
expose resources that the target policy was meant to protect.

I reproduced this through the daemon HTTPS API with a client certificate
restricted to the source and target projects. Direct creation of a container
with `raw.lxc=lxc.apparmor.profile=unconfined` in the target was rejected, but
moving the same instance from the source succeeded and preserved that config.

Canonical's advisory and patches are:

https://github.com/canonical/lxd/security/advisories/GHSA-5g5r-wh97-qcq2
https://github.com/canonical/lxd/pull/18605
https://github.com/canonical/lxd/commit/ba6e583b7a417fbe4043e3abdfb922a1fe6494f7
https://github.com/canonical/lxd/pull/18821
https://github.com/canonical/lxd/commit/8d122a86c4f52c088c341ebbce0cdc5070876b43

The attached patch is an adapted backport, rather than a byte-for-byte copy:
Trixie's older 5.0.2 source predates prerequisite upstream refactoring. It puts
the same target-project AllowInstanceCreation and AllowSnapshotCreation checks
at the common copy path. It also follows these related stable-5.0 hardening
commits for cross-project copy and backup snapshot restore:

https://github.com/canonical/lxd/commit/16685963288b88179ef58451e2f0d7ede31037e2
https://github.com/canonical/lxd/commit/e9506926a0c42a61f7f624a2d3c6fbf9c7bd3e1c

It applies cleanly to Trixie, preserves source behavior, rejects the PoC, and
also validates the related cross-project copy and snapshot restore paths.

Could this be included in a Trixie security update?

AI tools were used to assist this research and draft. The attached patch and
its PoC were manually validated against Trixie.

Regards,
Artem Dinaburg
Trail of Bits