Incus is a system container and virtual machine manager. A nil‑pointer dereference in internal/server/storage/backend.go allows an authenticated user with permission to create instances in any project to upload a crafted backup tarball that causes the Incus daemon to panic and crash. The crash terminates the daemon process, leading to a denial of service for every project on the affected cluster member. This flaw is equivalent to several other recent GitHub Security Advisories and was fixed in version 7.1.0.

The vulnerable product is Incus from the LXC project. All installations of Incus earlier than 7.1.0 are susceptible. The fix was incorporated in Incus 7.1.0; later releases also contain the patch. Administrators should verify the current version and apply the update accordingly.

The CVSS score is 4.4, indicating moderate severity, and the EPSS score is not available, suggesting no readily identified exploitation data at this time. The vulnerability is listed as not in the CISA KEV catalog. Exploitation requires authentication with instance‑creation rights and involves uploading a malicious backup archive to the instance‑import API. Once executed, the daemon will crash, requiring a restart, and causing a temporary loss of service for all users on that node. Although the risk of widespread exploitation is currently low, the impact to availability makes patching a priority.