# CVE-2026-48756: LXC Incus nil-pointer dereference in CreateCustomVolumeFromBackup

Source: https://junglewise.ai/threats/cve-2026-48756-lxc-incus-nil-pointer-dereference-in-createcustomvolumefrombackup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-48756 · Severity: medium · CVSS 4 · Published 2026-08-21

Incus, a tool for managing containers and virtual machines, is vulnerable to a denial-of-service attack. An authenticated user can crash the central management service (incusd) by uploading a specially crafted backup file that is missing specific timing information. This crash stops all active container operations and prevents the system from responding to new requests until an administrator manually restarts the service.

Technologies: [github.com/lxc/incus (Go)](https://junglewise.ai/threats/technologies/github-com-lxc-incus), [github.com/lxc/incus/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-lxc-incus-v6), [github.com/lxc/incus/v7 (Go)](https://junglewise.ai/threats/technologies/github-com-lxc-incus-v7), [github.com/lxc/incus/v7/cmd/incusd (Go)](https://junglewise.ai/threats/technologies/github-com-lxc-incus-v7-cmd-incusd), [Linux Containers Project Incus](https://junglewise.ai/threats/technologies/incus). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Linux Containers Project](https://junglewise.ai/threats/vendors/linux-containers-project).

## Quick answers

**Is CVE-2026-48756 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48756 being exploited in the wild.

**How severe is CVE-2026-48756?** Medium severity, with a CVSS score of 4, published 21 August 2026.

**Which products and versions are affected?** github.com/lxc/incus (Go) SEMVER:introduced=0; github.com/lxc/incus/v6 (Go) SEMVER:introduced=0; github.com/lxc/incus/v7 (Go) SEMVER:introduced=0,fixed=7.1.0; github.com/lxc/incus/v7/cmd/incusd (Go) < 7.1.0, SEMVER:introduced=0,fixed=7.1.0; and 1 more.

**Is there a fix for CVE-2026-48756?** Yes. github.com/lxc/incus/v7 (Go): upgrade to 7.1.0 or later; github.com/lxc/incus/v7/cmd/incusd (Go): upgrade to 7.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48756 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-48756?** Check whether you run github.com/lxc/incus (Go), github.com/lxc/incus/v6 (Go), github.com/lxc/incus/v7 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/lxc/incus/v7 (Go): upgrade to 7.1.0 or later

  ```sh
  go get github.com/lxc/incus/v7@v7.1.0
  ```

- github.com/lxc/incus/v7/cmd/incusd (Go): upgrade to 7.1.0 or later

  ```sh
  go get github.com/lxc/incus/v7/cmd/incusd@v7.1.0
  ```


## Technical details

A nil-pointer dereference (CWE-476) exists in `internal/server/storage/backend.go` within the `CreateCustomVolumeFromBackup` function. The vulnerability occurs because the `ExpiresAt` field of a volume snapshot is dereferenced without a nil check when importing a custom volume backup. An authenticated attacker with `can_create_storage_volumes` permissions can trigger a panic in the `incusd` daemon by uploading a backup tarball containing a `backup/index.yaml` where the `expires_at` field is omitted. Because the operation runner lacks a recovery mechanism, the resulting panic terminates the entire process. This issue is fixed in version 7.1.0.

## Affected products

- LXC Incus < 7.1.0

## Identifiers

- CVE-2026-48756
- GHSA-xhqx-mgh3-3h7q
- GO-2026-5810

## Timeline

- 2026-05-28: disclosed
- 2026-06-26: advisory

## References

- [https://api.github.com/users/tonghuaroot](https://api.github.com/users/tonghuaroot)
- [https://github.com/tonghuaroot](https://github.com/tonghuaroot)
- [https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D](https://api.github.com/users/tonghuaroot/gists%7B/gist_id%7D)
- [https://api.github.com/users/tonghuaroot/repos](https://api.github.com/users/tonghuaroot/repos)
- [https://avatars.githubusercontent.com/u/23011166?v=4](https://avatars.githubusercontent.com/u/23011166?v=4)
- [https://api.github.com/users/tonghuaroot/events%7B/privacy%7D](https://api.github.com/users/tonghuaroot/events%7B/privacy%7D)

## Related threats

- [Incus project restriction bypass in instance copy](https://junglewise.ai/threats/cve-2026-55622-incus-project-restriction-bypass-in-instance-copy)
- [Incus authorization bypass in custom volume copy](https://junglewise.ai/threats/cve-2026-55621-incus-authorization-bypass-in-custom-volume-copy)
- [LXC Incus arbitrary file write via image hash path traversal](https://junglewise.ai/threats/cve-2026-48769-lxc-incus-arbitrary-file-write-via-image-hash-path-traversal)
- [LXC Incus argument injection in backup compression algorithm](https://junglewise.ai/threats/cve-2026-48755-lxc-incus-argument-injection-in-backup-compression-algorithm)
- [Incus nil-pointer dereference in createDependentVolumesFromBackup](https://junglewise.ai/threats/cve-2026-48754-incus-nil-pointer-dereference-in-createdependentvolumesfrombackup)