LXD: incomplete low-level denylist lets a restricted-project VM editor reach host root

Impact

The denylist that enforces restricted.virtual-machines.lowlevel=block omits raw.apparmor and raw.qemu.conf, so the restriction that is supposed to keep a project tenant away from hypervisor internals does not cover the two keys that matter most. A user with can_edit on a VM in a restricted project sets an AppArmor rule plus a QEMU chardev that bridges the LXD Unix socket into the guest, then drives LXD itself from inside the VM - first as cluster administrator, then as host root. For an operator this is a full break of the project boundary LXD multi-tenancy is built on: one tenant owns the host and, through the LXD cluster API, every other instance on it, including GPU passthrough devices attached to other tenants' VMs. Affects LXD 4.12 through 6.7.

Who can reach it

A user holding can_edit permission on a VM instance inside a restricted LXD project - a normal delegated tenant, not an admin. Authenticated access to the LXD API is required; no host access needed.

What to do

Upgrade LXD past 6.7 to a release carrying the fix in lxd/project/limits/permissions.go and restart the LXD daemon on every cluster member - instances keep running across a daemon restart, so this is a rolling control-plane update rather than a node drain. Until then, treat can_edit in restricted projects as equivalent to host root and withdraw it from untrusted tenants. Audit existing instance configs for raw.apparmor and raw.qemu.conf values.

References

Related entries

• Go x/crypto ssh/agent: destination restrictions silently dropped when adding keys to a remote agentCVE-2026-39832 · golang.org/x/crypto/ssh/agent (constraint extension serialization)Critical
• Linux kernel libceph: corrupted message frame causes out-of-bounds reads in process_message_header()CVE-2026-43406 · Linux kernel libceph (process_message_header bounds check)Critical
• Linux kernel libceph: signed payload_len in auth replies causes slab out-of-bounds readCVE-2026-43407 · Linux kernel libceph (ceph_handle_auth_reply payload_len integer overflow)Critical
• Linux kernel libceph: positive result field in an auth reply sends kernel memory past the front bufferCVE-2026-46119 · Linux kernel libceph (auth reply result field / __send_prepared_auth_request length)Critical
• Linux kernel libceph: osdmap_decode() under-counts osd_weight, allowing out-of-bounds readsCVE-2026-52958 · Linux kernel libceph (osdmap_decode max_osd bounds check)Critical
• Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: Nvmet_auth_reply()CVE-2026-64319 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical