CVE-2026-48756: Incus System Container Manager DOS Vulnerability

CVE-2026-48756 Overview

CVE-2026-48756 is a null pointer dereference vulnerability in Incus, a system container and virtual machine manager. The flaw resides in the (*backend).CreateCustomVolumeFromBackup function in internal/server/storage/backend.go. Prior to version 7.1.0, the function performs an unguarded *time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with can_create_storage_volumes permission on any project can crash the incusd daemon by uploading a crafted backup tarball. The issue is classified under CWE-476 (NULL Pointer Dereference).

Critical Impact
An authenticated low-privileged user can crash the incusd daemon by uploading a backup tarball with a missing expires_at field, causing denial of service to all hosted containers and virtual machines.

Affected Products

Incus versions prior to 7.1.0
incusd daemon component
Deployments exposing storage volume creation to authenticated users

Discovery Timeline

2026-08-21 - CVE-2026-48756 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-48756

Vulnerability Analysis

The vulnerability is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). A prior commit 985a1dedf9f3e7ba729c93b654905ed510de25c2 added an if s == nil guard at the top of the loop body in CreateCustomVolumeFromBackup. However, the fix did not extend to the adjacent *snapshot.ExpiresAt dereference located 19 lines later. Every other consumer of Config.VolumeSnapshots[i].ExpiresAt in the same file gates the dereference with a nil-check. The asymmetric guard is the root defect that enables the crash.

Root Cause

The ExpiresAt field is declared as a *time.Time pointer, meaning it is optional. When a backup tarball omits the volume_snapshots[*].expires_at field, the pointer remains nil. The vulnerable code path dereferences this pointer without validation, triggering a runtime panic in the Go runtime. Because incusd handles all volumes and containers on the host, the panic terminates the entire daemon process.

Attack Vector

An authenticated user with the can_create_storage_volumes permission on any project can trigger the crash. The attacker crafts a custom-volume backup tarball whose backup.yaml contains snapshot entries without the expires_at field. Uploading the tarball through the volume import API invokes CreateCustomVolumeFromBackup, which iterates over the snapshots and dereferences the nil pointer. No user interaction is required beyond the authenticated API call.

No public proof-of-concept exploit code is available. See the GitHub Security Advisory GHSA-xhqx-mgh3-3h7q for the maintainer's technical description.

Detection Methods for CVE-2026-48756

Indicators of Compromise

Unexpected incusd daemon crashes correlated with recent custom-volume backup import API calls
Go runtime panic entries in system logs referencing backend.go and CreateCustomVolumeFromBackup
Volume import requests originating from low-privileged accounts that hold only can_create_storage_volumes

Detection Strategies

Inspect incusd audit logs for POST requests to storage volume import endpoints followed by service restart events
Parse imported backup tarballs and flag backup.yaml files where volume_snapshots[*].expires_at is absent while other snapshot fields are present
Correlate systemd or supervisor restart events for incusd with the identity of the authenticated caller that initiated the last volume import

Monitoring Recommendations

Enable verbose logging on the Incus API server and forward stack traces to a central log store
Alert on any runtime error: invalid memory address or nil pointer dereference panic emitted by incusd
Track the volume of custom-volume backup imports per user to identify anomalous upload activity

How to Mitigate CVE-2026-48756

Immediate Actions Required

Upgrade Incus to version 7.1.0 or later, which contains the updated patch guarding the *snapshot.ExpiresAt dereference
Audit project role bindings and remove the can_create_storage_volumes permission from accounts that do not require it
Restrict network access to the Incus API endpoint to trusted management networks only

Patch Information

Version 7.1.0 of Incus contains the updated patch. The fix extends the existing nil-check pattern to the ExpiresAt dereference in CreateCustomVolumeFromBackup within internal/server/storage/backend.go. Refer to the GitHub Security Advisory GHSA-xhqx-mgh3-3h7q for the full commit reference.

Workarounds

Revoke the can_create_storage_volumes permission from all non-administrative users until the upgrade is applied
Place the Incus API behind a reverse proxy that inspects and rejects custom-volume backup imports
Configure the incusd service to auto-restart on failure to reduce downtime while the patch is being deployed

bash

# Verify installed Incus version and upgrade
incus version

# Debian/Ubuntu upgrade example
sudo apt update && sudo apt install --only-upgrade incus

# Confirm daemon is running the patched build (>= 7.1.0)
incus info | grep -i server_version