CVE-2026-48754: Incus System Manager DOS Vulnerability

CVE-2026-48754 is a denial of service vulnerability in Incus system container and virtual machine manager caused by unguarded pointer dereferences. Authenticated users can crash the incusd daemon. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-48754 Overview

CVE-2026-48754 is a null pointer dereference vulnerability [CWE-476] in Incus, a system container and virtual machine manager. The flaw resides in the (*backend).createDependentVolumesFromBackup function in internal/server/storage/backend.go. An authenticated user with can_create_instances permission on any project can crash the incusd daemon by uploading a maliciously crafted instance backup tarball. The vulnerability affects all versions prior to 7.1.0.

Critical Impact
Authenticated users with instance creation privileges can trigger a daemon crash by supplying a backup tarball whose dependent_volumes[*] block contains a nil snapshot pointer or omits the volume: or pool: fields, resulting in denial of service.

Affected Products

Incus system container and virtual machine manager
Incus versions prior to 7.1.0
Deployments exposing incusd to authenticated project users

Discovery Timeline

2026-08-21 - CVE-2026-48754 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-48754

Vulnerability Analysis

The vulnerability sits inside (*backend).createDependentVolumesFromBackup in internal/server/storage/backend.go. The function iterates over each dependent-volume entry parsed from an imported backup tarball. During iteration, the code dereferences VolumeSnapshots[i], Volume, and Pool sub-fields without validating that these pointers are non-nil.

An attacker holding can_create_instances on any project can craft a tarball whose dependent_volumes[*] block contains a nil snapshot pointer, or omits the volume: or pool: keys entirely. Uploading this tarball forces incusd to dereference a nil pointer and terminate. The daemon crash disrupts container and virtual machine management for every tenant sharing the affected node.

Root Cause

The defect is a sibling-field variant of the earlier batch fix commit d768f81c0a1d985f35ae56219519822b080bf5e3 ("Properly check dependent volumes on import"). That commit added an if disk == nil guard at the top of the outer loop. The patch did not extend the same nil-check to the four sub-pointer fields that the loop body dereferences without protection. The result is an incomplete input validation control on user-supplied backup metadata [CWE-476].

Attack Vector

Exploitation requires network access to the Incus API and authenticated credentials with can_create_instances on any project. The attacker constructs a backup archive whose YAML metadata declares dependent volumes with missing volume, pool, or snapshot entries. Submitting the archive through the standard import path invokes the vulnerable function and crashes the daemon. No additional privileges, user interaction, or kernel-level access are required.

The vulnerability is described in prose only. See the GitHub Security Advisory GHSA-4xg6-52mh-fpw8 for the upstream technical detail.

Detection Methods for CVE-2026-48754

Indicators of Compromise

Unexpected termination or restart events for the incusd process on cluster members
Recent instance backup imports from non-administrative project users preceding a daemon crash
Backup tarballs containing dependent_volumes[*] entries with missing volume: or pool: keys
Audit log entries showing can_create_instances API calls followed by service unavailability

Detection Strategies

Inspect incusd service logs for panics originating in internal/server/storage/backend.go near createDependentVolumesFromBackup
Correlate backup import API requests with subsequent daemon restarts on the same host
Validate uploaded backup archive YAML for structural completeness of dependent_volumes entries before processing

Monitoring Recommendations

Alert on repeated incusd crashes or systemd restart-loop conditions on Incus cluster nodes
Track authenticated API activity from low-privilege accounts, focusing on backup import endpoints
Monitor project-scoped permission grants that assign can_create_instances to non-trusted identities

How to Mitigate CVE-2026-48754

Immediate Actions Required

Upgrade Incus to version 7.1.0 or later on every server and cluster member
Audit project role bindings and remove can_create_instances from untrusted principals
Restrict network access to the Incus API to trusted administrative subnets until patched

Patch Information

Version 7.1.0 contains the updated patch that extends nil-pointer guards to the VolumeSnapshots[i], Volume, and Pool sub-fields inside createDependentVolumesFromBackup. This patch supplements the earlier batch fix commit d768f81c0a1d985f35ae56219519822b080bf5e3. Review the GitHub Security Advisory GHSA-4xg6-52mh-fpw8 for release details.

Workarounds

Disable instance backup imports for non-administrative users until upgrade completion
Apply project-level role restrictions to remove can_create_instances where the permission is not required
Front the Incus API with an authenticating reverse proxy that limits which identities can reach the backup import endpoint