CVE-2026-63298 LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration

High 8.7 Published 12 Aug 2026 Updated 13 Aug 2026

Authenticated attackers can inject arbitrary directives into LXD configuration files via NVIDIA settings, leading to arbitrary code execution on the host.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-63298?

CVE-2026-63298 is a high-severity command injection vulnerability in Canonical LXD, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.

Weakness: CWE-78

Which versions are affected by CVE-2026-63298?

It affects 1 product.

Products include Canonical Lxd.

How do I fix CVE-2026-63298?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-63298 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63298 exists.

Sources

Also known as DEBIAN-CVE-2026-63298, GHSA-vfh7-q59q-54v2, UBUNTU-CVE-2026-63298.