CVE-2026-48754
Received Received - Intake

Segmentation Fault in Incus Container Manager

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry's `VolumeSnapshots[i]`, `Volume`, and `Pool` sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch fix `d768f81c0a1d985f35ae56219519822b080bf5e3` ("Properly check dependent volumes on import"). That commit added `if disk == nil` at the top of the outer loop, but did not guard the four sub-pointer fields the loop body dereferences naked. Version 7.1.0 contains an updated patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-48754
EUVD
EUVD-2026-63981

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
incus incus to 7.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48754 is a vulnerability in Incus versions prior to 7.1.0. It allows an authenticated user with the can_create_instances permission to crash the incusd daemon by uploading a malformed backup tarball. The issue occurs in the createDependentVolumesFromBackup function where unguarded pointer dereferences on dependent volume entries' sub-fields can be triggered by a nil snapshot pointer or missing volume/pool fields.

Detection Guidance

Detecting this vulnerability requires checking the Incus version and monitoring for crashes in the incusd daemon. Run 'incus version' to verify if your system is running a version prior to 7.1.0. Check logs for daemon crashes after uploading backups, as this may indicate exploitation attempts.

Impact Analysis

This vulnerability can cause a persistent denial of service by crashing the incusd daemon. An attacker with the required permission can upload a crafted backup file to terminate the daemon, disrupting all container and virtual machine management services on the affected system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It is a denial-of-service issue in Incus that crashes the daemon, causing service disruption. Compliance impacts would be indirect, such as potential downtime affecting data availability or processing, but no data breach or unauthorized access is described.

Mitigation Strategies

Upgrade Incus to version 7.1.0 or later immediately. If upgrading is not possible, restrict the 'can_create_instances' permission to trusted users only and avoid uploading untrusted backup tarballs until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48754. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart