Improper Authorization in LXC - CVE-2026-39402

Vulnerability identifier: #VU128493

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-39402

CWE-ID: CWE-285

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper access control in lxc-user-nic delete authorization logic when deleting OVS-attached network interfaces. A local user can request deletion of another user's OVS port to cause a denial of service.

This is limited to multi-tenant environments using lxc-user-nic with OpenVswitch bridges, and exploitation requires a valid lxc-usernet policy entry on the same bridge.

LXC
Ubuntu
openEuler
Anolis OS
lxc (Ubuntu package)
lxc-devel
lxc-help
lxc-libs
lxc-debugsource
lxc-debuginfo
lxc
lxc-templates
lxc-doc

Install security update from vendor's website.

LXC - update to 7.0.0
lxc (Ubuntu package) - addressed in versions 2.0.11-0ubuntu1~16.04.3+esm1, 3.0.3-0ubuntu1~18.04.3+esm1, 1:4.0.12-0ubuntu1~20.04.1+esm1, 1:5.0.0~git2209-g5a7b9ce67-0ubuntu1.1+esm1, 1:5.0.3-2ubuntu7.3+esm1, 1:6.0.6-1ubuntu1+esm1
lxc-devel - update to 4.0.3-2022102419
lxc-help - update to 4.0.3-2022102419
lxc-libs - update to 4.0.3-2022102419
lxc-debugsource - update to 4.0.3-2022102419
lxc-debuginfo - update to 4.0.3-2022102419
lxc - update to 4.0.3-2022102419
lxc-templates - update to 7.0.0-1
lxc-doc - update to 7.0.0-1
lxc - update to 7.0.0-1
lxc-libs - update to 7.0.0-1
lxc-devel - update to 7.0.0-1

• https://github.com/lxc/lxc/security/advisories/GHSA-3m9j-g9gc-vcvq

• Improper Authorization in LXC
• Anolis OS update for lxc
• openEuler update for lxc
• Ubuntu update for lxc