CVE-2026-48756

CVE-2026-48756 is a nil-pointer dereference (CWE-476) in Incus , a system container and VM manager. The vulnerable function CreateCustomVolumeFromBackup in internal/server/storage/backend.go dereferences *snapshot.ExpiresAt without a nil-check when importing a custom-volume backup whose volume_sn...

CVE-2026-48756: NULL Pointer Dereference

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

CVE-2026-9639: NULL Pointer Dereference

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with cancreatestoragevolumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expiresat snapshot field...