A nil‑pointer dereference in the CreateCustomVolumeFromBackup function allows an authenticated user with can_create_storage_volumes rights to trigger a denial of service by uploading a backup tarball that omits the expires_at field of a snapshot. The error causes the LXD daemon to crash, leading to a service interruption. The weakness corresponds to uninitialized data use, identified as CWE‑476.

Canonical’s LXD container hypervisor is affected. All releases up to and including LXD 6.8, as well as LXD 5.21, are vulnerable; versions 5.21.5, 6.9, or newer contain the fix. The issue affects Linux deployments of LXD where the backup feature is enabled.

The CVSS score of 6.5 reflects a moderate severity vulnerability. EPSS is not available, so the current exploitation likelihood is unknown, and the vulnerability is not listed in CISA KEV. An attacker must be authenticated and have the can_create_storage_volumes permission to cause the crash, so the attack vector is local/privileged. If such a user can craft a malicious tarball, the daemon will terminate, resulting in downtime until a restart.