Back Linuxsecurity

Ubuntu 18.04 LXD Critical DoS Threat Advisory USN-8447

Linuxsecurity •LinuxSecurity Advisories • June 18, 2026

Several security issues were fixed in LXD. Software Description: - lxd: Container hypervisor based on LXC Details: USN-8447-1 fixed vulnerabilities in Go Cryptography. This update provides the corresponding updates for Go Cryptography code embedded in LXD for CVE-2026-39830, CVE-2026-39833, CVE-2026-39834, and CVE-2026-42508. Original advisory details: It was discovered that Go Cryptography did not properly handle SSH global request responses. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-39830) It was discovered that Go Cryptography did not properly verify user presence when using FIDO/U2F security keys. An attacker could possibly use this issue to bypass user presence verification for hardware security keys. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-39831) It was discovered that Go Cryptography did not properly serialize SSH agent key constraint extensio... Read the Full Advisory

Several security issues were fixed in LXD.

Software Description:

- lxd: Container hypervisor based on LXC

USN-8447-1 fixed vulnerabilities in Go Cryptography. This update provides

the corresponding updates for Go Cryptography code embedded in LXD for

CVE-2026-39830, CVE-2026-39833, CVE-2026-39834, and CVE-2026-42508.

Original advisory details:

It was discovered that Go Cryptography did not properly handle SSH global

request responses. A remote attacker could possibly use this issue to cause

a denial of service. (CVE-2026-39830)

It was discovered that Go Cryptography did not properly verify user

presence when using FIDO/U2F security keys. An attacker could possibly use

this issue to bypass user presence verification for hardware security keys.

This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04

LTS, and Ubuntu 26.04 LTS. (CVE-2026-39831)

It was discovered that Go Cryptography did not properly serialize SSH agent

key constraint extensio...

The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS lxd 3.0.3-0ubuntu1~18.04.2+esm3 Available with Ubuntu Pro Ubuntu 16.04 LTS lxd 2.0.11-0ubuntu1~16.04.4+esm3 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2026-39830, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508

Ubuntu Security Notice USN-8447-2

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in Go Cryptography Affecting Ubuntu Systems On June 17, 2026, Ubuntu released USN-8447-1 addressing several vulnerabilities in Go Cryptography. These include CVE-2026-39830, which allows denial of service via improper handling of SSH global request responses, and CVE-2026-39831, which enables bypassing user presence verification for FIDO/U2F keys. The vulnerabilities affect various Ubuntu versions, including 20.04 LTS, 22.04 LTS, 24.04 LTS, and 26.04 LTS. Other vulnerabilities include CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, and CVE-2026-42508, all published on May 22, 2026. Users are advised to update their systems to mitigate these risks. The issues could lead to significant security breaches if left unaddressed. 4 sources 58

Extracted Entities

Ubuntu 18.04 LXD Critical DoS Threat Advisory USN-8447

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (5)

Platforms (1)