CVE-2025-64507: Incus Privilege Escalation Vulnerability

CVE-2025-64507 Overview

CVE-2025-64507 affects Incus, a system container and virtual machine manager maintained by the LinuxContainers project. The flaw allows an unprivileged user with root access inside a container, and unprivileged shell access on the host, to escalate to root on the host. Exploitation requires a custom storage volume attached to the container with the security.shifted property set to true. The attacker writes a setuid binary from within the container and executes it on the host. The issue is tracked under [CWE-269: Improper Privilege Management].

Critical Impact
Local unprivileged users on shared Incus hosts can gain full root privileges by abusing shifted custom storage volumes to plant setuid binaries.

Affected Products

Linuxcontainers Incus versions prior to 6.0.6 (LTS branch)
Linuxcontainers Incus versions prior to 6.19.0 (feature branch)
Deployments using incus-user with the incus group to provide restricted access to unprivileged users

Discovery Timeline

2025-11-10 - CVE-2025-64507 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64507

Vulnerability Analysis

The vulnerability resides in how Incus handles custom storage volumes that carry the security.shifted property. This property enables idmap shifting so the same volume can be reused across containers with different uid/gid mappings. When an unprivileged user holds root inside a container, that user can write files to the shifted volume with arbitrary ownership and mode bits. Those bits, including the setuid bit, are preserved when the same volume path is read from the host namespace. An attacker with shell access on the host then executes the planted binary and inherits root privileges outside the container boundary.

Root Cause

The root cause is improper privilege management around shifted volumes. Incus did not sufficiently restrict the ability of an unprivileged Incus user, acting through incus-user and the incus group, to create storage volumes with security.shifted=true. Combined with kernel and filesystem support for idmapped mounts, this permitted container-side writes with host-effective setuid semantics.

Attack Vector

Exploitation is local and does not require user interaction or prior privileges beyond membership in the incus group. The attacker creates a custom storage volume with security.shifted enabled, attaches it to a container they control, writes a setuid root binary into the volume from inside the container, and then executes that binary as an unprivileged user on the host filesystem path that backs the volume.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-56mx-8g9f-5crf for additional technical context.

Detection Methods for CVE-2025-64507

Indicators of Compromise

Creation of custom storage volumes with the security.shifted property set to true by unprivileged Incus users
Setuid binaries appearing under storage volume backing paths on the host filesystem
Unexpected incus storage volume create or incus storage volume set operations originating from members of the incus group

Detection Strategies

Audit Incus API and CLI activity for security.shifted=true volume configuration changes performed by non-administrative users
Inspect host directories backing custom storage volumes for files with mode bits 04xxx or 02xxx owned by root
Correlate process execution events on the host where the executable path resolves into an Incus storage pool directory

Monitoring Recommendations

Enable Linux auditd rules for execve events sourced from Incus storage pool mount points
Log all administrative Incus operations and ship them to a central SIEM for review
Alert on any new setuid file creation events outside of package-managed paths

How to Mitigate CVE-2025-64507

Immediate Actions Required

Upgrade Incus to version 6.0.6 (LTS) or 6.19.0 as soon as patched packages are available
Inventory all custom storage volumes and identify any with security.shifted=true set by non-administrative users
Remove or restrict membership in the incus group until the host is patched

Patch Information

The LinuxContainers project tracks the fix in GitHub issue lxc/incus#2641 and merges the remediation through pull request lxc/incus#2642. Patched releases are Incus 6.0.6 and 6.19.0. Refer to the GitHub Security Advisory GHSA-56mx-8g9f-5crf for the authoritative advisory.

Workarounds

Manually restrict permissions so unprivileged users cannot create custom storage volumes with security.shifted=true
Disable use of incus-user for untrusted local users until upgrades are complete
Ensure host filesystem paths backing Incus storage pools are not reachable as executable paths by unprivileged users

bash

# Identify shifted custom storage volumes after upgrade planning
incus storage volume list --all-projects --format csv | \
  awk -F, '$2=="custom"{print $1"/"$3}' | \
  while read vol; do
    incus storage volume get "${vol%%/*}" "${vol#*/}" security.shifted 2>/dev/null \
      | grep -q true && echo "shifted: $vol"
  done

# Remove unprivileged users from the incus group as an interim control
sudo gpasswd -d <username> incus