Description
Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lxc | incus | < 7.3.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | incus | 7.0.1-2 | — |
| Debian 13 | incus | 6.0.4-2+deb13u9 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | incus | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | incus | 7.4-1.1 | openSUSE-SU-2026:11651-1 |
Advisories 1
- openSUSE-SU-2026:11651-1 incus-7.4-1.1 on GA media SUSE / openSUSE Security Updates · Sep 1, 2026