Vulnerability · Published Aug 21, 2026 · Assigned by GitHub_M
CVE-2026-48756Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)
Low 2.1
In plain English
A low-severity null pointer dereference in incus from lxc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with `can_create_storage_volumes` permission on any project can crash the `incusd` daemon by uploading a backup tarball whose `volume_snapshots[*].expires_at` field is absent. This is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). Commit `985a1dedf9f3e7ba729c93b654905ed510de25c2` added `if s == nil` at the top of the loop body, but did not guard the adjacent `*snapshot.ExpiresAt` deref 19 lines later. Every other consumer of `Config.VolumeSnapshots[i].ExpiresAt` in this same file already gates the deref with a nil-check — the asymmetric guard is the bug. Version 7.1.0 contains an updated patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | incus | 7.0.1-r0 | ALPINE-CVE-2026-48756 |
| Debian:13 | incus | 6.0.4-2+deb13u8 | DEBIAN-CVE-2026-48756 |
| Debian:14 | incus | 7.0.0-2 | DEBIAN-CVE-2026-48756 |
| Go | github.com/lxc/incus | no fix listed | GO-2026-5810 |
| Go | github.com/lxc/incus/v6 | no fix listed | GO-2026-5810 |
| Go | github.com/lxc/incus/v7 | 7.1.0 | GO-2026-5810 |
| Go | github.com/lxc/incus/v7/cmd/incusd | 7.1.0 | GHSA-xhqx-mgh3-3h7q |
| Ubuntu:25.10 | incus | no fix listed | UBUNTU-CVE-2026-48756 |
| Ubuntu:26.10 | incus | no fix listed | UBUNTU-CVE-2026-48756 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
References
- https://github.com/lxc/incus/security/advisories/GHSA-xhqx-mgh3-3h7q x_refsource_CONFIRM