CVE-2026-63298

Description

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.

Traduire en français

Produits concernés

• Canonical LXD

Scores CVSS

Faiblesses (CWE)

• CWE-78

Références

• https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2 Vendor AdvisoryExploitMitigation
• https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2 Vendor AdvisoryExploitMitigation

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories