Skip to content
OpenAdvisories
Low · 2.1 CVE-2026-48754 EUVD-2026-63981GHSA-4xg6-52mh-fpw8GO-2026-5800

Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}

Published Aug 21, 2026 · Updated Aug 26, 2026 · Assigned by GitHub_M

Description

Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry's `VolumeSnapshots[i]`, `Volume`, and `Pool` sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch fix `d768f81c0a1d985f35ae56219519822b080bf5e3` ("Properly check dependent volumes on import"). That commit added `if disk == nil` at the top of the outer loop, but did not guard the four sub-pointer fields the loop body dereferences naked. Version 7.1.0 contains an updated patch.

Affected products

VendorProductAffectedFixed
lxc incus < 7.1.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 incus 7.0.0-2 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 incus No fix yet —
Ubuntu 25.10 incus No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS incus No fix yet —
Ubuntu Pro 24.04 LTS incus No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed incus 7.4-1.1 openSUSE-SU-2026:11651-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
ReleasePackageFixed inAdvisory
Alpine v3.24 incus 7.0.1-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/lxc/incus all versions — GO-2026-5800
Go github.com/lxc/incus/v6 all versions — GO-2026-5800
Go github.com/lxc/incus/v7 < 7.1.0 7.1.0 GO-2026-5800
Go github.com/lxc/incus/v7/cmd/incusd < 7.1.0 7.1.0 GHSA-4xg6-52mh-fpw8

Advisories 2

References