The vulnerability resides in Incus, a system container and virtual machine manager, where the internal server storage backend fails to guard a nil dereference of the ExpiresAt field for volume snapshots during the creation of a custom volume from a backup. An authenticated user who has permission to create storage volumes in any project can upload a crafted backup tarball lacking the volume_snapshots[*].expires_at field. This causes the incusd daemon to crash, resulting in a denial of service for all users on the affected host. The flaw is a sibling‑field variant of a previously identified GHSA-r7w7 issue and was not fully mitigated by the patch added before the release of 7.1.0. The final patch in version 7.1.0 adds a nil check before dereferencing the ExpiresAt pointer, fully correcting the problem. The impact is limited to availability; the crash does not expose data or elevate privileges. However, any interruption to the incusd service can hinder all container and VM operations on the host.

Incus versions earlier than 7.1.0 are affected, specifically any build of the lxc:incus product that ships with the unpatched backend.go file. Users operating within any Incus project that grant the can_create_storage_volumes right are vulnerable as the attack requires authenticated access and the privilege to create storage volumes.

The CVSS score of 2.1 classifies the vulnerability as low severity. The attack vector requires authentication and is limited to privileged users who can create storage volumes. Because the vulnerability results only in a service crash, it is not listed in the CISA KEV catalog. Although the likelihood of exploitation is low, the internal impact on service availability makes it advisable to remediate promptly.