PT-2026-47213 · Incus · Incus
CVE-2026-48754
·
Published
2026-05-29
·
Updated
2026-07-07
CVSS v4.0
2.1
Low
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P |
Name of the Vulnerable Software and Affected Versions
Incus version 7.0.0
Description
An authenticated user with
can create instances permission can cause a denial of service by crashing the incusd daemon. The issue occurs when the daemon processes an instance backup tarball containing a malformed backup/index.yaml file. Specifically, the createDependentVolumesFromBackup() function in internal/server/storage/backend.go fails to properly validate sub-fields within the dependent volumes block, leading to a nil pointer dereference.An attacker can trigger this by sending a
POST request to the /1.0/instances endpoint with a backup file where the dependent volumes list contains a nil snapshot pointer or omits the volume or pool fields. This results in a runtime panic and crashes the entire incusd process, aborting all active container, VM, and storage operations on the host or cluster member.Recommendations
For Incus version 7.0.0, update the
createDependentVolumesFromBackup() function to include validation checks that ensure disk.Volume, disk.Pool, and each element within disk.VolumeSnapshots are not nil before they are dereferenced.Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Incus