Canonical LXD includes an incomplete denylist that fails to block raw.apparmor and raw.qemu.conf options when the restricted.virtual-machines.lowlevel=block setting is enabled. An attacker who can edit a virtual machine in a restricted project can inject an AppArmor rule and a QEMU chardev configuration that forwards the LXD Unix socket into the guest, giving the attacker escalation power to the cluster administrator and ultimately host root. This weakness corresponds to CWE-184 and directly permits privilege escalation beyond the intended project boundaries.

Canonical LXD versions 4.12 through 6.7 are impacted. Users running any of these releases should assess whether their environments use the restricted.virtual-machines.lowlevel=block project constraint and grant can_edit permissions on virtual machines.

The vulnerability carries a CVSS score of 9.1, indicating critical severity. While an EPSS score is not available, the high CVSS and lack of mitigation in affected releases suggest a strong likelihood of exploitation. A remote attacker only requires write permission on a VM within a restricted project to exploit the flaw, then can remotely inject configuration changes that give cluster administrator and finally host root access. The vulnerability is not listed in CISA’s KEV catalog, but the impact remains considerable for any system exposed to this misconfiguration.