Debian LXD DSA-6373-1: Container Host Security Update Checklist

Debian published DSA-6373-1 for LXD on June 28, 2026. If you run Debian 13 trixie hosts with the Debian lxd package, treat this as a container and virtual machine host maintenance item. The advisory lists multiple LXD issues that can allow security restriction bypasses or arbitrary command execution risk.

This is not a reason to panic-patch blind. LXD sits on a host boundary, so the safe path is to confirm where it is installed, protect the host state, update during a maintenance window, and verify tenant isolation afterward.

What Changed

Debian says the affected package is lxd. For Debian 13 trixie, the fixed package version is 5.0.2+git20231211.1364ae4-9+deb13u7.

The Debian advisory lists these CVEs:

• CVE-2026-9639
• CVE-2026-9640
• CVE-2026-48749
• CVE-2026-48750
• CVE-2026-48751
• CVE-2026-48752
• CVE-2026-48755
• CVE-2026-48769
• CVE-2026-55621
• CVE-2026-55622

Several of those CVEs overlap with the recent Incus security release coverage, but this Debian advisory is its own action path for Debian-packaged LXD systems.

Who Should Check

• Debian 13 trixie servers that use LXD for containers or virtual machines.
• Hosting, agency, SaaS, lab, and MSP environments where LXD hosts run customer, staging, CI, or internal workloads.
• Admin workstations or automation nodes that manage LXD remotes or trusted clients.
• Backup, image, or migration systems that interact with LXD instances.

Safe Maintenance Path

1. Inventory LXD hosts first. Confirm which Debian systems actually have the Debian lxd package installed and whether they expose an API, run remote clients, or host tenant workloads.
2. Protect the current state. Take host-level backups or snapshots where practical, confirm recent container and VM backups, and make sure you can restore at least one representative workload before changing production hosts.
3. Plan tenant impact. If the host serves customers, schedule a maintenance window, drain workloads where your environment supports it, and warn customers if restart or migration work may briefly affect service.
4. Apply the Debian security update. Use your normal Debian security update workflow, managed patching platform, or hosting automation. The target fixed version for trixie is 5.0.2+git20231211.1364ae4-9+deb13u7 or newer.
5. Verify isolation after the update. Review restricted projects, profiles, storage pools, image sources, trusted client access, backup import/export paths, and cross-project copy behavior.
6. Check post-change health. Confirm containers and VMs start normally, network profiles still behave as expected, storage mounts are intact, backups still complete, and logs do not show unexpected permission or profile errors.

Attack Status

The Debian advisory does not state that these LXD issues are being actively exploited. This Fix I.T. Phill radar pass also did not find a newer CISA Known Exploited Vulnerabilities catalog entry for this LXD advisory. The risk still matters because container and VM managers sit close to host and tenant isolation boundaries.

Hosting Notes

If LXD is part of a hosting or customer platform, separate three pieces of work: package patching, tenant-boundary verification, and customer communication. Do not assume the package update alone proves every isolation control is still configured correctly. Review the host access model, remote API exposure, admin workstation access, backup handling, and image intake process as part of the same maintenance window.

If you also run Incus, read the related Fix I.T. Phill checklist: Incus 7.2 Security Update: Host and Tenant Isolation Checklist.

Official Sources

• Debian Security Advisory DSA-6373-1: lxd security update
• Debian security tracker for LXD