Read the docs
TI-2026-29009 Aliases CVE-2026-40195GHSA-gc7j-g665-rxr9

Incus nil-pointer dereference in storage bucket import allows denial of service

Priority MEDIUM 64CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-476.

Summary

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup metadata handling logic, where the daemon processes the index.yaml file from an imported archive and accesses members of the parsed backup configuration without first verifying that the configuration object was initialized. A malicious or malformed index.yaml that omits the config block causes a nil-pointer dereference during bucket import operations and terminates the daemon. Repeated use of this issue can be used to keep Incus offline, causing a denial of service. This issue is fixed in version 7.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00398 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed incus (lxc): 7.0.0github.com/lxc/incus/v6/cmd/incusd (Go): 7.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lxcincusbefore 7.0.07.0.0Patch availableCNA
—github.com/lxc/incus/v6/cmd/incusd (Go)before 7.0.07.0.0Patch availableGHSA-gc7j-g665-rxr9
  • incus Vendorlxc Affected before 7.0.0 Fixed in 7.0.0 Patch available CNA
  • github.com/lxc/incus/v6/cmd/incusd (Go) Vendor— Affected before 7.0.0 Fixed in 7.0.0 Patch available GHSA-gc7j-g665-rxr9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*before 7.0.0Vulnerablelxc
  • cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:* Versions before 7.0.0 Vulnerable ·lxc

Remediation

  • Fix · CNA incus (lxc) Fixed in 7.0.0
  • Fix · GHSA-gc7j-g665-rxr9 github.com/lxc/incus/v6/cmd/incusd (Go) Fixed in 7.0.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40195
  2. 2026-10-03 Alias added: GHSA-gc7j-g665-rxr9

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-19296 Incus container image templating arbitrary host file read and write CVSS 3.1HIGH 8.7
  • TI-2026-19295 Incus container environment configuration newline injection CVSS 3.1HIGH 8.7
  • TI-2025-39899 Incus vulnerable to local privilege escalation through custom storage volumes CVSS 4.0HIGH 8.6
  • TI-2026-29045 Incus out-of-bounds panic in snapshot metadata handling allows denial of service CVSS 4.0HIGH 7.1
  • TI-2026-26122 Incus vulnerable to denial of source through crafted bucket backup file CVSS 3.1MEDIUM 6.5
  • TI-2026-25935 Incus does not verify combined fingerprint when downloading images from simplestreams servers CVSS 4.0MEDIUM 5.7
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences