Executive brief
Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus
Affected products
- Go github.com/lxc/incus/v6/cmd/incusd
- Go github.com/lxc/incus/v6
- Go github.com/lxc/incus
- Go github.com/lxc/incus/v7
Junglewise Threat Intelligence
CVE-2026-40195: GO-2026-5397 - Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus
CVE-2026-40195 · Severity: low · CVSS 3.1 · Published 2026-06-25
Technologies: github.com/lxc/incus/v6/cmd/incusd (Go), github.com/lxc/incus/v6 (Go), github.com/lxc/incus (Go), github.com/lxc/incus/v7 (Go). Vendors: Go.
Related threats
- Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying whe
- Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copyin
- Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a m
- Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/serv
- Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression alg