CVE-2026-48754: Incus nil-pointer dereference in createDependentVolumesFromBackup

Executive brief

Incus is a container and virtual machine management tool. A vulnerability in how it handles instance backups allows an authenticated user to crash the management service (incusd) by uploading a specially crafted backup file. This results in a denial of service, preventing any further container or VM operations on the host until the service is manually restarted.

Technical details

A nil-pointer dereference exists in `internal/server/storage/backend.go` within the `createDependentVolumesFromBackup` function. The code fails to validate sub-fields (`Volume`, `Pool`, and elements of `VolumeSnapshots`) within the `DependentVolumes` configuration block of a backup index. An authenticated attacker with `can_create_instances` permissions can trigger a SIGSEGV panic by uploading a backup tarball containing a `backup/index.yaml` with omitted or null-valued dependent volume fields. This crashes the entire `incusd` process, leading to a persistent denial of service. The issue is confirmed in version 7.0.0 and addressed in version 7.1.0.

Affected products

• LinuX Containers (LXC) / Incus Project Incus 7.0.0

Timeline

• 2026-05-28: advisory: Initial GitHub Advisory published
• 2026-06-26: disclosed: Full details disclosed

References

• https://api.github.com/users/tonghuaroot
• https://github.com/tonghuaroot
• https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D
• https://api.github.com/users/tonghuaroot/repos
• https://avatars.githubusercontent.com/u/23011166?v=4
• https://api.github.com/users/tonghuaroot/events%7B/privacy%7D