CVE-2026-47753 Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)

What is CVE-2026-47753?

CVE-2026-47753 is a medium-severity vulnerability in lxc incus, published on 21 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go` contains a nil-pointer dereference that an authenticated user with permission to create instances in any project can trigger remotely by uploading a crafted backup tarball. The Incus daemon panics and the process crashes, causing denial of service to every project on that cluster member. This is a sibling of `GHSA-fwj8-62r8-8p8m`, `GHSA-r7w7-mmxr-47r9`, and `GHSA-x5r6-jr56-89pv` (all assigned 2026-05-04). Those patches added guards on adjacent fields of the same `backup/config.Config` struct; the `Volume` field on the instance-import path was missed. Version 7.1.0 contains an updated patch.

Weakness: CWE-476

Which versions are affected by CVE-2026-47753?

5 open source packages ship an affected version, including github.com/lxc/incus/v7, github.com/lxc/incus and github.com/lxc/incus/v6.

How do I fix CVE-2026-47753?

Upgrade github.com/lxc/incus/v7 to 7.1.0 or later.

Is CVE-2026-47753 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47753 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-47753, GHSA-8g7m-96c8-8wwc, GO-2026-5252, UBUNTU-CVE-2026-47753.