Database/Container, Kubernetes & orchestration

LXD: newline injection in NVIDIA instance config yields code execution as the LXD daemon

CVE-2026-63298Container, Kubernetes & orchestrationcurated

Impact

An authenticated user who can set instance configuration keys can embed newlines in the NVIDIA passthrough values, injecting arbitrary directives into the generated lxc.conf and executing code on the host with LXD daemon privileges - effectively root on the node. On a GPU host this is exactly the config surface a tenant touches to get a GPU into a container, so the escape path runs through the feature that makes the node useful. The record gives CVSS 9.9 with changed scope, reflecting a container-to-host boundary crossing. A compromised LXD host means every other instance on that node, and any GPU or fabric device passed into them, is under attacker control.

Who can reach it

An authenticated LXD user with permission to create or edit an instance's configuration. No host access needed; the injection happens through ordinary NVIDIA passthrough config values.

What to do

Apply the LXD update named in Canonical's GHSA-vfh7-q59q-54v2 advisory and restart the LXD daemon; the record does not state a fixed version, so check the advisory for the build that matches your channel. Until patched, restrict who may set nvidia.driver.capabilities and nvidia.require.* on instances, or reject values containing newlines in whatever provisioning layer sits in front of LXD.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-63298 https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.