CVE-2026-47753: Incus Container Manager DOS Vulnerability

CVE-2026-47753 Overview

CVE-2026-47753 is a nil-pointer dereference vulnerability in Incus, an open-source system container and virtual machine manager. The flaw resides in (*backend).CreateInstanceFromBackup within internal/server/storage/backend.go. An authenticated user with permission to create instances in any project can trigger the bug remotely by uploading a crafted backup tarball. The Incus daemon panics and the process crashes, denying service to every project hosted on the affected cluster member. The issue is a sibling of GHSA-fwj8-62r8-8p8m, GHSA-r7w7-mmxr-47r9, and GHSA-x5r6-jr56-89pv. Prior patches guarded adjacent fields on the same backup/config.Config struct but missed the Volume field on the instance-import path. Incus version 7.1.0 contains the corrected patch.

Critical Impact
An authenticated low-privilege user can crash the Incus daemon on a cluster member by uploading a malformed backup tarball, causing denial of service to every project on that node.

Affected Products

Incus system container and virtual machine manager
Incus versions prior to 7.1.0
Incus cluster deployments exposing instance-import functionality to authenticated users

Discovery Timeline

2026-08-21 - CVE-2026-47753 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-47753

Vulnerability Analysis

The vulnerability is a null pointer dereference [CWE-476] in the Incus daemon's backup import path. When CreateInstanceFromBackup processes a user-supplied backup tarball, it calls createDependentVolumesFromBackup, which iterates dependent volume entries described in the backup index. The index is deserialized into a backup/config.Config struct whose Volume, Pool, and VolumeSnapshots fields may be nil if the attacker omits or malforms them. The unguarded dereference occurs when the daemon accesses fields on those nil pointers, producing a Go runtime panic. Because the panic propagates in the daemon process, it terminates all in-flight operations on the cluster member and disrupts every project sharing that node.

Root Cause

Earlier remediations for sibling advisories added nil-guards on adjacent fields of the backup/config.Config struct. The Volume field on the instance-import path was not covered by those checks. Combined with an unchecked iteration over VolumeSnapshots entries that may contain nil elements, the daemon dereferences attacker-controlled pointers without validation.

Attack Vector

Exploitation requires an authenticated account with permission to create instances in any project on the Incus deployment. The attacker uploads a crafted backup archive whose index omits the Volume or Pool fields, or contains nil snapshot entries. When the daemon parses the archive, the panic terminates the process and causes a denial of service condition.

// Patch: internal/server/storage/backend.go
// incusd/storage: Guard nil fields in createDependentVolumesFromBackup
			return errors.New("Bad dependent volume definition found in index")
 		}
 
+		if disk.Volume == nil || disk.Pool == nil {
+			return errors.New("Bad dependent volume definition found in index")
+		}
+
 		optimizedStorage := srcBackup.OptimizedStorage
 		optimizedHeader := srcBackup.OptimizedHeader
 
 		snapshots := []string{}
 		for _, snap := range disk.VolumeSnapshots {
+			if snap == nil {
+				return errors.New("Bad dependent volume snapshot definition found in index")
+			}
+
 			snapshots = append(snapshots, snap.Name)
 		}
// Source: https://github.com/lxc/incus/commit/98e64f0a6fcfdc9676eea0246418d490c53297bf

Detection Methods for CVE-2026-47753

Indicators of Compromise

Unexpected Incus daemon process termination or panic entries in journalctl -u incus referencing CreateInstanceFromBackup or createDependentVolumesFromBackup.
Backup tarball upload API calls immediately followed by daemon restart events on the same cluster member.
Instance-import requests from low-privilege project accounts that do not normally perform restore operations.

Detection Strategies

Monitor Incus daemon logs for Go runtime panic stack traces containing nil pointer dereference inside the storage package.
Correlate API audit events for POST /1.0/instances with X-Incus-type: backup headers against subsequent daemon crash telemetry.
Alert on repeated failed instance-restore operations from a single authenticated principal across short time windows.

Monitoring Recommendations

Ingest Incus daemon logs and cluster member health metrics into a centralized log platform to detect crash-restart patterns.
Track service uptime for incus.service across all cluster members and alert on abnormal restart counts.
Review project-level permissions periodically to identify accounts holding instance-creation rights that should be scoped down.

How to Mitigate CVE-2026-47753

Immediate Actions Required

Upgrade Incus to version 7.1.0 or later on every cluster member.
Audit project role assignments and remove instance-creation permissions from accounts that do not require them.
Restrict network access to the Incus API to trusted management networks and administrative jump hosts.

Patch Information

The fix is applied in commit 98e64f0a6fcfdc9676eea0246418d490c53297bf and shipped in Incus 7.1.0. The patch adds explicit nil-checks for disk.Volume, disk.Pool, and each element of disk.VolumeSnapshots in createDependentVolumesFromBackup, returning a clear error rather than dereferencing invalid pointers. Refer to the GitHub Security Advisory GHSA-8g7m-96c8-8wwc and the upstream commit for full technical detail.

Workarounds

Temporarily revoke the ability to create instances from backup for non-administrative project members until the upgrade is complete.
Place the Incus API behind an authenticated reverse proxy that enforces per-user rate limits on instance-restore endpoints.
Enable process supervision so the daemon restarts quickly if a crash occurs, and monitor for repeated restarts as a triage signal.

bash

# Verify the installed Incus version and upgrade
incus --version

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade incus

# Confirm the daemon is running the fixed release (>= 7.1.0)
systemctl status incus
incus info | grep -i server_version