CVE-2026-48754 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
An authenticated user can crash the Incus daemon by uploading a malformed backup tarball, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48754?
CVE-2026-48754 is a low-severity vulnerability in lxc incus, published on 21 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry's `VolumeSnapshots[i]`, `Volume`, and `Pool` sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch fix `d768f81c0a1d985f35ae56219519822b080bf5e3` ("Properly check dependent volumes on import"). That commit added `if disk == nil` at the top of the outer loop, but did not guard the four sub-pointer fields the loop body dereferences naked. Version 7.1.0 contains an updated patch.
Weakness: CWE-476
Which versions are affected by CVE-2026-48754?
5 open source packages ship an affected version, including github.com/lxc/incus/v7/cmd/incusd, github.com/lxc/incus and github.com/lxc/incus/v6.
| Package | Affected | Fixed in |
|---|---|---|
github.com/lxc/incus/v7/cmd/incusd Go | All versions | 7.1.0 |
github.com/lxc/incus/v7/cmd/incusd Go | All versions | 7.1.0 |
github.com/lxc/incus Go | All versions | None |
github.com/lxc/incus/v6 Go | All versions | None |
github.com/lxc/incus/v7 Go | All versions | 7.1.0 |
How do I fix CVE-2026-48754?
Upgrade github.com/lxc/incus/v7/cmd/incusd to 7.1.0 or later.
Is CVE-2026-48754 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48754 exists.
Sources
Also known as DEBIAN-CVE-2026-48754, GHSA-4xg6-52mh-fpw8, GO-2026-5800, UBUNTU-CVE-2026-48754.