VYPR
← All advisories
High severity8.4NVD Advisory· Published Jun 26, 2026· Updated Jul 2, 2026

CVE-2026-12411

CVE-2026-12411

Description

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

Affected products

2
  • Canonical/Lxdllm-fuzzy2 versions
    (expand)+ 1 more
    • (no CPE)
    • cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*range: >=6.6,<6.9

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.