External risk intelligence

LXD NVIDIA Configuration Injection Leads to Host Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-63298

LXD is a system container manager typically deployed in isolated internal environments or on infrastructure hosts. It is not designed to be exposed directly to the public internet. This vulnerability requires an authenticated user to have sufficient privileges to modify instance configurations, further limiting its exposure to internal administrative or developer workflows.

OS Command Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in LXD's handling of NVIDIA instance configurations. An authenticated attacker could exploit this by injecting specific characters, leading to the execution of arbitrary code on the host system with LXD daemon privileges. The main concern is confirming relevance and exposure within your environment.

Malicious configuration can run code on host.
Affects LXD's NVIDIA instance setup.
Confirm if LXD is used with NVIDIA.

Attack Path

How an attacker could exploit the issue

An attacker with existing authenticated access to LXD could exploit this vulnerability by manipulating specific NVIDIA-related configuration settings for a container. By inserting newline characters into the 'nvidia.driver.capabilities' or 'nvidia.require.*' fields, they can alter the LXD configuration file, potentially leading to the execution of arbitrary code on the host system with LXD daemon privileges. The exact path for an attacker to reach and trigger this vulnerability is not fully detailed in the provided context, but it hinges on the ability to modify these specific configuration parameters.

Requires authenticated access to LXD.
Achieved by injecting newlines into NVIDIA settings.
Allows arbitrary code execution on the host.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker could inject arbitrary configuration directives into LXD's NVIDIA instance configuration. When supported by the advisory, this could lead to the execution of arbitrary code on the host system with the privileges of the LXD daemon, potentially affecting system data and service behavior.

System configuration and code execution.
Injecting directives into NVIDIA instance settings.
Arbitrary code execution with daemon privileges.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of this vulnerability likely falls to teams managing the LXD infrastructure and the applications running within it. The first practical step is to inventory all LXD instances, confirm their exposure and criticality, identify the specific application or service owners responsible for the affected configurations, and then prioritize remediation based on the potential impact.

LXD and host infrastructure owners.
Verify reachable, critical LXD instances.
Plan remediation with application owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is LXD and what is it used for?

LXD is a next-generation system container manager. It allows users to run and manage full Linux systems within lightweight containers, providing an experience similar to virtual machines but with higher efficiency. It is frequently used to manage infrastructure workloads and containerized services, particularly those requiring specific hardware acceleration like NVIDIA GPUs.

What does CVE-2026-63298 mean for system security?

This vulnerability is classified as Improper Neutralization of Special Elements (CWE-78). In simple terms, the software fails to properly filter input, allowing an attacker to inject unauthorized instructions. In the context of CVE-2026-63298, this flaw allows an attacker to alter the configuration of the container manager, ultimately gaining the ability to execute code on the host operating system with the high-level privileges of the LXD daemon.

How can an attacker trigger this vulnerability?

An attacker triggers this by modifying specific NVIDIA-related configuration settings for a container. By inserting newline characters into fields like 'nvidia.driver.capabilities', they can force the system to process unintended directives. Notably, a user without authenticated access to modify LXD instance configurations cannot trigger this bug; it requires prior authorization to change these specific settings.

Is my environment at risk from this LXD vulnerability?

According to Halo Surface Signal, this vulnerability is very unlikely to be exposed on the public internet. LXD is designed for isolated internal environments or infrastructure hosting, not direct exposure. You should focus on internal workflows where users have permissions to manage container configurations, as the primary risk stems from authorized users with sufficient privileges to alter settings.

What are the first steps to address this issue?

Begin by inventorying your infrastructure to identify all instances where LXD is configured to use NVIDIA hardware. Verify which systems and applications rely on these specific configurations. Once identified, coordinate with the responsible infrastructure and application owners to assess the criticality of those instances and plan for the necessary updates or configuration changes to secure the host.

References

github.com/canonical/lxd/security/advisories/GHSA-vfh7-q59q-54v2

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.