Description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry's `VolumeSnapshots[i]`, `Volume`, and `Pool` sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch fix `d768f81c0a1d985f35ae56219519822b080bf5e3` ("Properly check dependent volumes on import"). That commit added `if disk == nil` at the top of the outer loop, but did not guard the four sub-pointer fields the loop body dereferences naked. Version 7.1.0 contains an updated patch.
Published: 2026-08-21
Score: 2.1 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Incus, a system container and virtual machine manager, contains a nil‑pointer dereference in the function that imports dependent volumes. When the import handler processes a backup tarball that includes a dependent volume with a missing or null snapshot, volume, or pool reference, the daemon derefs an unguarded pointer and crashes. The flaw is a classic null‑pointer dereference (CWE‑476) and results only in a denial‑of‑service condition. No user privilege escalation or remote code execution is possible, and the impact is limited to service interruption for the affected cluster.

Affected Systems

LXC Incus system containers and virtual machine manager, all projects exposed to the Incus API, are vulnerable in versions prior to 7.1.0. Org-specific project settings that grant the can_create_instances permission are the attack surface.

Risk and Exploitability

The CVSS score of 2.1 classifies this flaw as low severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. Attackers must be authenticated and possess can_create_instances permission on a project; through normal API usage they can upload a crafted backup to trigger the crash. The resulting denial of service can disrupt operations until the daemon is recovered or upgraded.

Generated by OpenCVE AI on August 21, 2026 at 16:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Incus to version 7.1.0 or later, which contains the null‑pointer check that fixes the crash
  • If an upgrade cannot be performed immediately, remove or restrict the can_create_instances permission for projects until a patch is applied
  • Monitor event logs for incusd termination events and restart the daemon promptly to restore service while a permanent fix is applied

Generated by OpenCVE AI on August 21, 2026 at 16:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-4xg6-52mh-fpw8 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
History

Fri, 21 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Lxc
Lxc incus
Vendors & Products Lxc
Lxc incus

Fri, 21 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Description Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry's `VolumeSnapshots[i]`, `Volume`, and `Pool` sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch fix `d768f81c0a1d985f35ae56219519822b080bf5e3` ("Properly check dependent volumes on import"). That commit added `if disk == nil` at the top of the outer loop, but did not guard the four sub-pointer fields the loop body dereferences naked. Version 7.1.0 contains an updated patch.
Title Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
Weaknesses CWE-476
References
Metrics cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Lxc Incus
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-21T14:36:16.011Z

Reserved: 2026-05-22T19:39:05.356Z

Link: CVE-2026-48754

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-21T15:16:40.943

Modified: 2026-08-21T15:16:40.943

Link: CVE-2026-48754

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T17:00:03Z

Weaknesses