Vulnerability Description
An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Canonical | Lxd | >= 4.0.0, < 4.0.12 |
Related Weaknesses (CWE)
References
- https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2Vendor AdvisoryExploitMitigation
- https://github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2Vendor AdvisoryExploitMitigation
FAQ
What is CVE-2026-63298?
CVE-2026-63298 is a vulnerability with a CVSS score of 9.9 (CRITICAL). An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying...
How severe is CVE-2026-63298?
CVE-2026-63298 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-63298?
Check the references section above for vendor advisories and patch information. Affected products include: Canonical Lxd.