CVE-2026-48754

A flaw was found in Incus, a system container and virtual machine manager. An authenticated user with cancreateinstances permission can crash the incusd daemon by uploading a specially crafted instance backup tarball. This vulnerability, a nil-pointer dereference, leads to a Denial of Service DoS...

CVE-2026-48756

A flaw was found in Incus, a system container and virtual machine manager. An authenticated user with cancreatestoragevolumes permission can crash the incusd daemon. This occurs by uploading a crafted backup tarball where the volumesnapshots.expiresat field is absent, leading to an unguarded...

CVE-2026-48756

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

EUVD-2026-63981

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An...

CVE-2026-48754

Incus (system container and VM manager) prior to 7.1.0 contains a nil-pointer dereference (CWE-476) in (*backend).createDependentVolumesFromBackup in internal/server/storage/backend.go. The function dereferences VolumeSnapshots[i], Volume, and Pool sub-fields of dependent-volume entries without n...

CVE-2026-48754 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An...

EUVD-2026-63974

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

CVE-2026-48756 Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

CVE-2026-48756

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...