Skip to content
Fencer Vulns
medium 6.5

CVE-2026-39402 json

lxc lxc-user-nic insufficient ownership validation allows cross-tenant OVS port deletion

published 2026-05-05 6 mo ago modified 2026-07-24 3 mo ago also EUVD-2026-27497

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits
0
none known

Summary

lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw in the find_line() function that allows an unprivileged user to delete OVS-attached network interfaces belonging to other users. When lxc-user-nic delete scans its NIC database to authorize a deletion request, the interface name comparison can set the authorization flag based on a name match alone, even when the ownership, type, and link fields in that database entry belong to a different user. The vulnerable check sits after the goto next label handling, meaning it is reachable on lines where earlier ownership checks failed or were skipped. Because nothing downstream of this authorization signal re-verifies that the matched database line actually belongs to the caller, an unprivileged attacker with a valid lxc-usernet policy entry can trigger deletion of another user's OVS port on the same bridge.

This is limited to multi-tenant environments using lxc-user-nic with OpenVSwitch bridges. The impact is denial of service - one tenant can repeatedly disconnect networking from containers run by another tenant on shared infrastructure. This is patched in version 7.0.0.

Patch / fix

  • linuxcontainers lxc 7.0.0
  • lxc Debian 12 1:5.0.2-1+deb12u4
  • lxc Debian 13 1:6.0.4-4+deb13u3
  • lxc Debian 14 1:7.0.0-1

debian advisories DEBIAN-CVE-2026-39402

  • lxc Ubuntu Pro 18.04 LTS 3.0.3-0ubuntu1~18.04.3+esm1
  • lxc Ubuntu Pro 20.04 LTS 1:4.0.12-0ubuntu1~20.04.1+esm1
  • lxc Ubuntu Pro 22.04 LTS 1:5.0.0~git2209-g5a7b9ce67-0ubuntu1.1+esm1
  • lxc Ubuntu Pro 24.04 LTS 1:5.0.3-2ubuntu7.3+esm1
  • lxc Ubuntu Pro 26.04 LTS 1:6.0.6-1ubuntu1+esm1

ubuntu advisories UBUNTU-CVE-2026-39402

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • incus openSUSE Tumbleweed 7.4-1.1
  • lxc openSUSE Tumbleweed 7.0.0-1.1

opensuse advisories openSUSE-SU-2026:11651-1openSUSE-SU-2026:10678-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-39402 updated cvss 5.5

lxc: lxc-user-nic: OpenVSwitch: LXC: Denial of Service in lxc-user-nic due to logic flaw in network interface deletion

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/lxc/lxc/security/advisories/GHSA-3m9j-g9gc-vcvq referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 4.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
CNA 4.0 4.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products

  • lxc lxc

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.