Vulnerability · Published May 7, 2026 · Assigned by GitHub_M
CVE-2026-41647Incus: Nil-Pointer Dereference via S3 Bucket Import
Medium 6.5
In plain English
A medium-severity null pointer dereference in incus from lxc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 66.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | incus | 7.0.0-r0 | ALPINE-CVE-2026-41647 |
| Debian:13 | incus | 6.0.4-2+deb13u7 | DEBIAN-CVE-2026-41647 |
| Debian:14 | incus | 7.0.0-1 | DEBIAN-CVE-2026-41647 |
| Go | github.com/lxc/incus | no fix listed | GO-2026-5384 |
| Go | github.com/lxc/incus/v6 | no fix listed | GO-2026-5384 |
| Go | github.com/lxc/incus/v6/cmd/incusd | no fix listed | GHSA-fwj8-62r8-8p8m |
| Ubuntu:25.10 | incus | no fix listed | UBUNTU-CVE-2026-41647 |
| Ubuntu:26.10 | incus | no fix listed | UBUNTU-CVE-2026-41647 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/lxc/incus/security/advisories/GHSA-fwj8-62r8-8p8m x_refsource_CONFIRM
- https://github.com/lxc/incus/releases/tag/v7.0.0 x_refsource_MISC