PT-2026-37101 · Incus · Incus

Stamparm · Published 2026-05-04 · Updated 2026-05-07 · CVE-2026-40195

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.0.0

Description Missing validation logic in the storage bucket import process allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The issue occurs in the backup metadata handling logic when the daemon processes the index.yaml file from an imported archive. Specifically, the daemon accesses members of the parsed backup configuration without verifying that the configuration object was initialized. A malformed index.yaml that omits the config block triggers a nil-pointer dereference—a runtime error in Go that occurs when attempting to access memory through a pointer that is not pointing to a valid object—within the CreateBucketFromBackup() function. This results in a daemon crash and can be repeatedly exploited to cause a denial of service, keeping Incus offline.

Recommendations Update to version 7.0.0.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-40195

GHSA-GC7J-G665-RXR9

Affected Products

Incus

References · 13

• 🔥 https://github.com/lxc/incus/security/advisories/GHSA-gc7j-g665-rxr9 · Exploit
• https://cve.org/CVERecord?id=CVE-2026-40195 · Security Note
• https://ubuntu.com/security/CVE-2026-40195 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gc7j-g665-rxr9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40195 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-40195 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40195 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40195 · Vendor Advisory
• https://github.com/lxc/incus · Note
• https://github.com/lxc/incus/pull/3273 · Note
• https://t.me/CVEtracker/52915 · Telegram Post
• https://twitter.com/CVEnew/status/2052430098339340647 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052253679860814014 · Twitter Post