# CVE-2026-48754: Incus nil-pointer dereference in createDependentVolumesFromBackup

Source: https://junglewise.ai/threats/cve-2026-48754-incus-nil-pointer-dereference-in-createdependentvolumesfrombackup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-48754 · Severity: medium · CVSS 4 · Published 2026-08-21

Incus is a container and virtual machine management tool. A vulnerability in how it handles instance backups allows an authenticated user to crash the management service (incusd) by uploading a specially crafted backup file. This results in a denial of service, preventing any further container or VM operations on the host until the service is manually restarted.

Technologies: [github.com/lxc/incus (Go)](https://junglewise.ai/threats/technologies/github-com-lxc-incus), [github.com/lxc/incus/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-lxc-incus-v6), [github.com/lxc/incus/v7 (Go)](https://junglewise.ai/threats/technologies/github-com-lxc-incus-v7), [github.com/lxc/incus/v7/cmd/incusd (Go)](https://junglewise.ai/threats/technologies/github-com-lxc-incus-v7-cmd-incusd). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-48754 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48754 being exploited in the wild.

**How severe is CVE-2026-48754?** Medium severity, with a CVSS score of 4, published 21 August 2026.

**Which products and versions are affected?** github.com/lxc/incus (Go) SEMVER:introduced=0; github.com/lxc/incus/v6 (Go) SEMVER:introduced=0; github.com/lxc/incus/v7 (Go) SEMVER:introduced=0,fixed=7.1.0; github.com/lxc/incus/v7/cmd/incusd (Go) < 7.1.0, SEMVER:introduced=0,fixed=7.1.0.

**Is there a fix for CVE-2026-48754?** Yes. github.com/lxc/incus/v7 (Go): upgrade to 7.1.0 or later; github.com/lxc/incus/v7/cmd/incusd (Go): upgrade to 7.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48754 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48754?** Check whether you run github.com/lxc/incus (Go), github.com/lxc/incus/v6 (Go), github.com/lxc/incus/v7 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/lxc/incus/v7 (Go): upgrade to 7.1.0 or later

  ```sh
  go get github.com/lxc/incus/v7@v7.1.0
  ```

- github.com/lxc/incus/v7/cmd/incusd (Go): upgrade to 7.1.0 or later

  ```sh
  go get github.com/lxc/incus/v7/cmd/incusd@v7.1.0
  ```


## Technical details

A nil-pointer dereference exists in `internal/server/storage/backend.go` within the `createDependentVolumesFromBackup` function. The code fails to validate sub-fields (`Volume`, `Pool`, and elements of `VolumeSnapshots`) within the `DependentVolumes` configuration block of a backup index. An authenticated attacker with `can_create_instances` permissions can trigger a SIGSEGV panic by uploading a backup tarball containing a `backup/index.yaml` with omitted or null-valued dependent volume fields. This crashes the entire `incusd` process, leading to a persistent denial of service. The issue is confirmed in version 7.0.0 and addressed in version 7.1.0.

## Affected products

- LinuX Containers (LXC) / Incus Project Incus 7.0.0

## Identifiers

- CVE-2026-48754
- GHSA-4xg6-52mh-fpw8
- GO-2026-5800

## Timeline

- 2026-05-28: advisory: Initial GitHub Advisory published
- 2026-06-26: disclosed: Full details disclosed

## References

- [https://api.github.com/users/tonghuaroot](https://api.github.com/users/tonghuaroot)
- [https://github.com/tonghuaroot](https://github.com/tonghuaroot)
- [https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D](https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D)
- [https://api.github.com/users/tonghuaroot/repos](https://api.github.com/users/tonghuaroot/repos)
- [https://avatars.githubusercontent.com/u/23011166?v=4](https://avatars.githubusercontent.com/u/23011166?v=4)
- [https://api.github.com/users/tonghuaroot/events%7B/privacy%7D](https://api.github.com/users/tonghuaroot/events%7B/privacy%7D)

## Related threats

- [Incus project restriction bypass in instance copy](https://junglewise.ai/threats/cve-2026-55622-incus-project-restriction-bypass-in-instance-copy)
- [Incus authorization bypass in custom volume copy](https://junglewise.ai/threats/cve-2026-55621-incus-authorization-bypass-in-custom-volume-copy)
- [LXC Incus arbitrary file write via image hash path traversal](https://junglewise.ai/threats/cve-2026-48769-lxc-incus-arbitrary-file-write-via-image-hash-path-traversal)
- [LXC Incus nil-pointer dereference in CreateCustomVolumeFromBackup](https://junglewise.ai/threats/cve-2026-48756-lxc-incus-nil-pointer-dereference-in-createcustomvolumefrombackup)
- [LXC Incus argument injection in backup compression algorithm](https://junglewise.ai/threats/cve-2026-48755-lxc-incus-argument-injection-in-backup-compression-algorithm)