CVE-2026-33711: Incus Privilege Escalation Vulnerability

CVE-2026-33711 Overview

CVE-2026-33711 is a symlink attack vulnerability in Incus, a system container and virtual machine manager. The flaw exists in the VM screenshot API, which uses predictable file paths under /tmp for temporary screenshot files. An attacker with local access can exploit this by creating symlinks at these predictable paths before Incus generates screenshots, potentially leading to denial of service or local privilege escalation on systems where the Linux kernel's protected_symlinks security feature is disabled.

Critical Impact

Local attackers can trick Incus into truncating and altering the mode and permissions of arbitrary files on the filesystem, potentially leading to denial of service or local privilege escalation on vulnerable systems.

Affected Products

• Incus versions prior to 6.23.0

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-33711 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33711

Vulnerability Analysis

This vulnerability is classified under CWE-61 (UNIX Symbolic Link Following), a race condition vulnerability type commonly known as Time-of-Check Time-of-Use (TOCTOU). The flaw resides in how Incus handles temporary files when retrieving VM screenshots through its API.

When a user requests a VM screenshot, Incus creates a temporary file in /tmp for QEMU to write the screenshot data. The API then reads this file, sends the content to the user, and deletes the temporary file. The issue arises because versions prior to 6.23.0 use predictable file paths for these temporary files, making them susceptible to symlink attacks.

The attack requires local access to the system. An attacker can pre-create symbolic links at the predictable temporary file locations, pointing to sensitive system files. When Incus subsequently creates the screenshot file at that location, file operations intended for the temporary screenshot are instead redirected to the symlink target.

Root Cause

The root cause is the use of predictable temporary file paths in the /tmp directory without proper validation of the file type before performing write operations. The vulnerability is a classic TOCTOU race condition where an attacker can interpose a symlink between the time Incus checks for the file and the time it performs operations on it.

On most Linux systems, the kernel's protected_symlinks feature mitigates this attack by preventing processes from following symlinks in world-writable directories unless the symlink owner matches the follower. However, on systems where this protection is purposefully disabled, the full exploit chain becomes viable.

Attack Vector

The attack vector is local, requiring the attacker to have existing access to the target system. The attacker must:

1. Identify the predictable temporary file paths used by Incus for VM screenshots
2. Create symbolic links at these paths pointing to target files they wish to manipulate
3. Trigger or wait for a legitimate user to request a VM screenshot
4. When Incus performs file operations on the temporary path, the symlink redirects these operations to the attacker-chosen target file

The vulnerability is exploited through symbolic link manipulation in the /tmp directory. When Incus attempts to create and write to its predictable temporary file path, the pre-existing symlink causes the write operations to be redirected to whatever file the symlink points to. This can result in file truncation, permission changes, or mode alterations on arbitrary files. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-33711

Indicators of Compromise

• Suspicious symlink creation in /tmp directory pointing to sensitive system files
• Unexpected file permission or mode changes on critical system files
• Anomalous file truncation events on configuration or system files
• Evidence of local users creating symlinks in /tmp immediately before VM screenshot requests

Detection Strategies

• Monitor file system events in /tmp for symlink creation by non-root users
• Implement auditd rules to track symlink syscalls (symlinkat, symlink) in /tmp
• Alert on unexpected changes to file permissions or modes on sensitive system files
• Track Incus API calls for VM screenshots and correlate with /tmp file system activity

Monitoring Recommendations

• Enable Linux audit framework with rules targeting /tmp directory symlink operations
• Deploy file integrity monitoring (FIM) on critical system files to detect unauthorized modifications
• Monitor Incus logs for screenshot API requests and correlate with system-level file operations
• Review systems for protected_symlinks kernel setting and ensure it remains enabled

How to Mitigate CVE-2026-33711

Immediate Actions Required

• Upgrade Incus to version 6.23.0 or later immediately
• Verify that the Linux kernel's protected_symlinks feature is enabled on all systems
• Audit /tmp directory for suspicious symlinks that may indicate attempted exploitation
• Restrict local access to systems running vulnerable Incus versions

Patch Information

The vulnerability is fixed in Incus version 6.23.0. The patch addresses the predictable temporary file path issue by implementing secure temporary file handling. Administrators should upgrade to version 6.23.0 or later to remediate this vulnerability. For additional details, refer to the GitHub Security Advisory.

Workarounds

• Ensure the Linux kernel's protected_symlinks feature is enabled by verifying /proc/sys/fs/protected_symlinks is set to 1
• Restrict local shell access to systems running Incus to trusted users only
• Consider mounting /tmp with the nosymfollow option if supported by your system
• Monitor and audit all local user activity on systems running vulnerable versions

# Verify protected_symlinks is enabled
cat /proc/sys/fs/protected_symlinks
# Should return: 1

# Enable protected_symlinks if disabled
echo 1 > /proc/sys/fs/protected_symlinks

# Make the setting persistent across reboots
echo "fs.protected_symlinks = 1" >> /etc/sysctl.conf
sysctl -p