PT-2026-36945 · Canonical · Incus

Stamparm · Published 2026-05-04 · Updated 2026-05-07 · CVE-2026-40197

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Incus (affected versions not specified)

Description A nil-pointer dereference exists in the custom volume backup import subsystem. An authenticated user with access to the storage volume feature can cause the Incus daemon to crash by importing a crafted backup archive. The issue occurs because the daemon iterates over the VolumeSnapshots slice in srcBackup.Config and dereferences elements without validating if they are initialized. An attacker can provide an index.yaml file containing explicit null array elements in the volume snapshots array, which the YAML unmarshaler converts into nil pointers. This triggers a crash in the CreateCustomVolumeFromBackup() function, leading to a denial of service on the node.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-40197

GHSA-R7W7-MMXR-47R9

Affected Products

Incus

References · 13

• https://github.com/lxc/incus/security/advisories/GHSA-r7w7-mmxr-47r9 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40197 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40197 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40197 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r7w7-mmxr-47r9 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40197 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-40197 · Security Note
• https://github.com/lxc/incus · Note
• https://github.com/lxc/incus/pull/3273 · Note
• https://t.me/CVEtracker/52916 · Telegram Post
• https://twitter.com/CVEnew/status/2052430097001353222 · Twitter Post
• https://twitter.com/dailycve/status/2051428834386337858 · Twitter Post