LXD 4.0.12 release notes

This is a LTS release and is recommended for production use.

Release notes content

These release notes cover updates in the core LXD repository and the LXD snap package.

This is a maintenance release for the 4.0 LTS series. It focuses on security hardening, stricter input validation, and bug fixes backported from the main development branch.

Highlights

This section highlights notable improvements in this release.

Security hardening for image and backup handling

Several hardening fixes were backported to reduce archive and template-related attack surface:

• Reject non-regular metadata files after unpack.

• Reject unconfined backup metadata.

• Prevent instance templates from escaping the templates directory.

• Validate backup instance and volume names during import.

NVIDIA configuration validation improvements

Validation for NVIDIA-related instance configuration was tightened and applied consistently at set time and start time. This includes stricter validation for nvidia.driver.capabilities, nvidia.require.cuda, and nvidia.require.driver.

Bug fixes

The following bug fixes are included in this release.

• Arbitrary file read and write via image metadata.yaml symlink (GHSA-j825-cg34-5fr5)

• NVIDIA configuration validation bypass for nvidia.require.* and nvidia.driver.capabilities (GHSA-vfh7-q59q-54v2)

• Restricted project bypass for security.idmap.isolated defaults (GHSA-7vp9-3vmp-c5jm)

• Unconfined backup.yaml accepted after unpack in crafted backups (GHSA-fv82-v4fj-mm4m)

• Prevent image metadata templates from escaping the instance directory (GHSA-9hcm-hxh5-7xxh)

• Validate backup import names to prevent path traversal during restore (GHSA-m857-c7gc-c984)

Change log

View the complete list of all changes in this release.

Downloads

The source tarballs and binary clients can be found on our download page.

Binary packages are also available for:

• Linux: snap install lxd --channel=4.0/stable

• MacOS client: brew install lxc

• Windows client: choco install lxc