CVE-2026-48756
Received Received - Intake

Unguarded ExpiresAt Dereference in Incus Custom Volume Backup

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with `can_create_storage_volumes` permission on any project can crash the `incusd` daemon by uploading a backup tarball whose `volume_snapshots[*].expires_at` field is absent. This is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). Commit `985a1dedf9f3e7ba729c93b654905ed510de25c2` added `if s == nil` at the top of the loop body, but did not guard the adjacent `*snapshot.ExpiresAt` deref 19 lines later. Every other consumer of `Config.VolumeSnapshots[i].ExpiresAt` in this same file already gates the deref with a nil-check — the asymmetric guard is the bug. Version 7.1.0 contains an updated patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-48756
EUVD
EUVD-2026-63974

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48756 is a nil-pointer dereference flaw in Incus, a container and VM manager. It occurs in the CreateCustomVolumeFromBackup function when processing backup tarballs. If a volume snapshot's ExpiresAt field is missing, an authenticated user with storage volume creation rights can crash the incusd daemon by causing a nil pointer dereference.

Detection Guidance

To detect this vulnerability, monitor for crashes or restarts of the incusd daemon, particularly after importing custom-volume backups. Check logs for panic errors related to nil-pointer dereference in storage operations. No specific commands are provided in the context, but ensure your Incus version is updated to 7.1.0 or later.

Impact Analysis

This vulnerability allows an authenticated attacker to crash the Incus daemon (incusd), causing a denial of service. All storage operations stop until the daemon is manually restarted, disrupting container and VM management. The attack requires low privileges and network access.

Compliance Impact

This vulnerability causes a denial-of-service by crashing the incusd daemon, disrupting storage operations. For GDPR, this could lead to unauthorized processing interruptions affecting data integrity. For HIPAA, service disruptions may impact availability of protected health information systems.

Mitigation Strategies

Immediately upgrade Incus to version 7.1.0 or later to patch the vulnerability. Restrict user permissions to prevent unauthorized access to storage volume creation. Monitor system logs for signs of exploitation attempts or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48756. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart