Skip to content
Heist/ feed
UnratedFix available

DEBIAN-CVE-2026-39402

Type: advisorySource: OSV1 source record

lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw in the find_line() function that allows an unprivileged user to delete OVS-attached network interfaces belonging to other users. When lxc-user-nic delete scans its NIC database to authorize a deletion request, the interface name comparison can set the authorization flag based on a name match alone, even when the ownership, type, and link fields in that database entry belong to a different user. The vulnerable check sits after the goto next label handling, meaning it is reachable on lines where earlier ownership checks failed or were skipped. Because nothing downstream of this authorization signal re-verifies that the matched database line actually belongs to the caller, an unprivileged attacker with a valid lxc-usernet policy entry can trigger deletion of another user's OVS port on the same bridge. This is limited to multi-tenant environments using lxc-user-nic with OpenVSwitch bridges. The impact is denial of service - one tenant can repeatedly disconnect networking from containers run by another tenant on shared infrastructure. This is patched in version 7.0.0.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-39402

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-39402

lxc

Source reference: /affected/0/package/name

Affected versions
1:5.0.2-1

Source reference: /affected/0/versions

1:5.0.2-1+deb12u1

Source reference: /affected/0/versions

1:5.0.2-1+deb12u2

Source reference: /affected/0/versions

1:5.0.2-1+deb12u3

Source reference: /affected/0/versions

Fixed versions
1:5.0.2-1+deb12u4

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

lxc

Source reference: /affected/1/package/name

Affected versions
1:6.0.4-4

Source reference: /affected/1/versions

1:6.0.4-4+deb13u1

Source reference: /affected/1/versions

1:6.0.4-4+deb13u2

Source reference: /affected/1/versions

Fixed versions
1:6.0.4-4+deb13u3

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

lxc

Source reference: /affected/2/package/name

Affected versions
1:6.0.4-4

Source reference: /affected/2/versions

1:6.0.5-1

Source reference: /affected/2/versions

1:6.0.5-2

Source reference: /affected/2/versions

1:6.0.6-1

Source reference: /affected/2/versions

1:6.0.6-2

Source reference: /affected/2/versions

1:6.0.6-3

Source reference: /affected/2/versions

Fixed versions
1:7.0.0-1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:5.0.2-1+deb12u4"
          }
        ]
      }
    ],
    "package": {
      "name": "lxc",
      "purl": "pkg:deb/debian/lxc?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "1:5.0.2-1",
      "1:5.0.2-1+deb12u1",
      "1:5.0.2-1+deb12u2",
      "1:5.0.2-1+deb12u3"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-39402.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:6.0.4-4+deb13u3"
          }
        ]
      }
    ],
    "package": {
      "name": "lxc",
      "purl": "pkg:deb/debian/lxc?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "1:6.0.4-4",
      "1:6.0.4-4+deb13u1",
      "1:6.0.4-4+deb13u2"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-39402.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:7.0.0-1"
          }
        ]
      }
    ],
    "package": {
      "name": "lxc",
      "purl": "pkg:deb/debian/lxc?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "1:6.0.4-4",
      "1:6.0.5-1",
      "1:6.0.5-2",
      "1:6.0.6-1",
      "1:6.0.6-2",
      "1:6.0.6-3"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-39402.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#56918 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement