These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A critical path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions or launching a crafted image to overwrite arbitrary host files as root, achieving host root code execution. This issue arises from LXD's validation of target template paths in metadata.yaml against a confined directory handle, but subsequent file creation using an unconfined str [truncated]
A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing path trave [truncated]
A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted im [truncated]
An authenticated attacker with can_create_instances permissions on a restricted project can bypass project-level security restrictions in LXD by exploiting an improper validation vulnerability in the instancePostMigration function. This allows the attacker to migrate an instance between projects, potentially leading to unauthorized access or elevated privileges.
An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the [truncated]
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. This vulnerability can lead to potential security control bypass and unauthorized access to LXD instances. The LXD authorization bypass occurs when migrating an instance to a target project, as LXD accepts configuration overrides without validating the new configur [truncated]
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges, LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. This vulnerability can be exploited by creating or updating an instance without explicitly sett [truncated]
An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. The vulnerability occurs when moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: <target>, and target: <member>. The destination node skips all project restriction che [truncated]
A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sand [truncated]
A high-severity vulnerability, CVE-2026-15226, exists in Canonical snapd's internal execution environment compiler (snap-confine). The default seccomp security templates do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or [truncated]
An access control bypass and information disclosure vulnerability exists in Canonical snapd's base AppArmor security profile configuration. The issue allows strictly confined snap applications to interact with systemd's user database, potentially leading to unauthorized access to system password hashes. This vulnerability has specific conditions required for exploitation and is mitigated by the fact that [truncated]
A critical vulnerability was discovered in Canonical ubuntu-pro-client, allowing for arbitrary code execution with root privileges. The vulnerability exists due to improper input validation and injection in the ubuntu-pro-client, which constructs APT source files using data received from the contract server response. This could allow an attacker to inject arbitrary deb configuration lines. Ubuntu Server u [truncated]
A Server-Side Request Forgery (SSRF) vulnerability exists in Canonical LXD versions 4.12 through 6.9. The vulnerability is located in the image import functionality and allows authenticated users with the can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a URL source, the LXD daemon fails to validate or restrict outbound d [truncated]
CVE-2026-9640 is a high-severity privilege escalation vulnerability in LXD, a container hypervisor. The vulnerability exists in LXD versions from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7. An authenticated project operator in a restricted multi-tenant environment can exploit this vulnerability by importing a maliciously crafted instance backup containing restricted configuration keys wi [truncated]
CVE-2026-9639 is a medium-severity vulnerability in LXD, a container hypervisor, that allows an authenticated user with 'can_create_storage_volumes' permissions to cause a denial of service. The vulnerability is due to a nil-pointer dereference in the 'CreateCustomVolumeFromBackup' function. An attacker can exploit this vulnerability by providing a specially crafted custom-volume backup tarball that omits [truncated]
CVE-2026-12411 is a HIGH severity vulnerability in Canonical LXD, allowing an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled. The vulnerability has a CVSS score of 8.4 and was published on June 26, 2026. The CVE record and NVD detail provide further information on this v [truncated]
A NULL pointer dereference vulnerability exists in Ubuntu Linux kernel versions 6.8, 6.17, and 7.0 within SAUCE patches handling AF_INET/AF_INET6 socket mediation. An unprivileged local user can trigger this flaw, resulting in a kernel oops (denial of service). The vulnerability is classified as LOW severity with a CVSS 3.1 score of 3.3. The issue was published on 2026-05-28 and is tracked as CWE-476. No [truncated]
A use-of-uninitialized-variable flaw exists in Ubuntu's SAUCE-patched Linux 6.8 kernel within the AppArmor LSM's AF_INET/AF_INET6 socket mediation path. The bug can be triggered by an unprivileged local user and may cause AppArmor to apply incorrect fine-grained network-socket mediation decisions. The vulnerability was introduced via Ubuntu-specific SAUCE patches and is not present in upstream Linux. The [truncated]
A NULL pointer dereference vulnerability exists in Ubuntu Linux 6.8 within SAUCE patches handling AppArmor notifications. An unprivileged local user can trigger this flaw to cause a kernel panic, resulting in denial of service. The vulnerability was disclosed on 2026-05-28 with a CVSS 3.1 score of 5.5 (MEDIUM severity). The issue is tracked as CWE-476 (NULL Pointer Dereference). The vulnerability affects [truncated]
A vulnerability in Ubuntu Linux kernel AppArmor SAUCE patches allows unprivileged local users to trigger kernel panic or deadlock through incorrect spinlock handling in notification code. The flaw affects Ubuntu kernels 6.8, 6.17, and 7.0, where the notification handling code sleeps while holding a spinlock—a violation of kernel locking semantics that can cause system instability. This is classified as a [truncated]
CVE-2026-47333 is a heap memory out-of-bounds read vulnerability in Ubuntu Linux kernel AppArmor SAUCE patches affecting versions 6.8, 6.17, and 7.0. The flaw stems from incorrect buffer size computation in notification handling code, which can be triggered by an unprivileged local user and may cause invalid data processing by the AppArmor DFA policy engine. The vulnerability was published on 2026-05-28 w [truncated]
A medium-severity local information disclosure vulnerability exists in Ubuntu Linux kernel versions 6.8, 6.17, and 7.0. The issue stems from AppArmor SAUCE patches that fail to properly validate the size of an internal structure during notification handling, resulting in an out-of-bounds read. An unprivileged local attacker can trigger this flaw to leak information from adjacent slab objects. The vulnerab [truncated]
A race condition in Ubuntu's AppArmor SAUCE patches for Linux kernel 6.8 allows unprivileged local users to trigger use-after-free (UAF) conditions. The vulnerability stems from missing lock acquisition during linked list modifications, which could theoretically enable arbitrary code execution with elevated privileges. This affects Ubuntu's kernel packaging and requires local access to exploit.
A vulnerability in Ubuntu Linux kernel AppArmor SAUCE patches allows unprivileged local users to trigger use of an uninitialized variable in notification handling code, potentially causing incorrect caching of AppArmor notification responses. The issue affects Ubuntu Linux versions 6.8, 7.17, and 7.0. The vulnerability has a LOW severity CVSS score of 3.3 and was published on May 28, 2026. The root cause [truncated]
A validation flaw in Ubuntu's SAUCE patches for Linux kernel versions 6.8, 6.17, and 7.0 allows unprivileged local users to trigger improper handling of AppArmor notification responses. The vulnerability stems from insufficient validation of the name field size in these responses. The CVSS 3.1 score of 3.3 (Low severity) reflects the local attack vector and limited impact scope. The issue was disclosed on [truncated]
A memory management vulnerability exists in Ubuntu Linux kernel versions 6.8, 6.17, and 7.0 due to defective AppArmor SAUCE patches. The flaw involves an incorrect attempt to free a pointer that was not allocated via kmalloc(), coupled with a memory leak. An unprivileged local attacker can trigger this bug, leading to slab metadata corruption and potential resource exhaustion. The vulnerability is classif [truncated]
A NULL pointer dereference vulnerability exists in Ubuntu Linux kernel SAUCE patches for AppArmor notifications. The flaw affects kernel versions 6.8, 6.17, and 7.0. An unprivileged local user can trigger the bug, resulting in a kernel oops (denial of service). The vulnerability was published on 2026-05-28 with a CVSS 3.1 score of 3.3 (Low severity). The root cause is improper NULL pointer handling in App [truncated]
A memory leak vulnerability exists in Ubuntu Linux kernel SAUCE patches affecting versions 6.8, 6.17, and 7.0. The flaw occurs in the handling of big responses to AppArmor notifications and can be triggered by an unprivileged local user, potentially leading to resource exhaustion through memory exhaustion. The vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). The [truncated]
A path containment bypass vulnerability in Canonical Multipass's host-side SFTP server component (sshfs_server) allows a local attacker with root privileges inside a guest virtual machine to read arbitrary files on the host filesystem. The vulnerability exists in the validate_path function in src/sshfs_mount/sftp_server.cpp, which performs a plain string prefix comparison on requested paths without proper [truncated]
This CVE documents an incomplete remediation of CVE-2025-5199 in Canonical Multipass for macOS. Version 1.16.0 corrected ownership of the multipassd daemon binary to root:wheel, but left five auxiliary binaries in /Library/Application Support/com.canonical.multipass/bin/ owned by the installing user and writable. The root LaunchDaemon (com.canonical.multipassd.plist) configures a PATH that prioritizes thi [truncated]
