CVE-2025-54288

Name	CVE-2025-54288
Description	Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
incus (PTS)	trixie	6.0.4-2	vulnerable
	forky	6.0.5-1	vulnerable
	sid	6.0.5-2	vulnerable
lxd (PTS)	bookworm	5.0.2-5	vulnerable
	trixie	5.0.2+git20231211.1364ae4-9	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
incus	source	(unstable)	(unfixed)
lxd	source	(unstable)	(unfixed)

https://github.com/canonical/lxd/security/advisories/GHSA-7232-97c6-j525