CVE-2026-48756: LXC Incus nil-pointer dereference in CreateCustomVolumeFromBackup

Executive brief

Incus, a tool for managing containers and virtual machines, is vulnerable to a denial-of-service attack. An authenticated user can crash the central management service (incusd) by uploading a specially crafted backup file that is missing specific timing information. This crash stops all active container operations and prevents the system from responding to new requests until an administrator manually restarts the service.

Technical details

A nil-pointer dereference (CWE-476) exists in `internal/server/storage/backend.go` within the `CreateCustomVolumeFromBackup` function. The vulnerability occurs because the `ExpiresAt` field of a volume snapshot is dereferenced without a nil check when importing a custom volume backup. An authenticated attacker with `can_create_storage_volumes` permissions can trigger a panic in the `incusd` daemon by uploading a backup tarball containing a `backup/index.yaml` where the `expires_at` field is omitted. Because the operation runner lacks a recovery mechanism, the resulting panic terminates the entire process. This issue is fixed in version 7.1.0.

Affected products

• LXC Incus < 7.1.0

Timeline

• 2026-05-28: disclosed
• 2026-06-26: advisory

References

• https://api.github.com/users/tonghuaroot
• https://github.com/tonghuaroot
• https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D
• https://api.github.com/users/tonghuaroot/repos
• https://avatars.githubusercontent.com/u/23011166?v=4
• https://api.github.com/users/tonghuaroot/events%7B/privacy%7D