TI-2026-36027 Aliases CVE-2026-48756 GHSA-xhqx-mgh3-3h7q

NULL pointer dereference in lxc incus

LOW 11CWE-476Published 2026-08-21 · Updated 2026-08-21

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-476.

Summary

Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with `can_create_storage_volumes` permission on any project can crash the `incusd` daemon by uploading a backup tarball whose `volume_snapshots[*].expires_at` field is absent. This is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). Commit `985a1dedf9f3e7ba729c93b654905ed510de25c2` added `if s == nil` at the top of the loop body, but did not guard the adjacent `*snapshot.ExpiresAt` deref 19 lines later. Every other consumer of `Config.VolumeSnapshots[i].ExpiresAt` in this same file already gates the deref with a nil-check — the asymmetric guard is the bug. Version 7.1.0 contains an updated patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00382 32nd percentileScored 2026-11-07

Fix Fixed incus (lxc): 7.1.0github.com/lxc/incus/v7/cmd/incusd (Go): 7.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
lxc	incus	before 7.1.0	7.1.0	Patch available	CNA
—	github.com/lxc/incus/v7/cmd/incusd (Go)	before 7.1.0	7.1.0	Patch available	GHSA-xhqx-mgh3-3h7q

incus Vendorlxc Affected before 7.1.0 Fixed in 7.1.0 Patch available CNA
github.com/lxc/incus/v7/cmd/incusd (Go) Vendor— Affected before 7.1.0 Fixed in 7.1.0 Patch available GHSA-xhqx-mgh3-3h7q

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxcontainers:incus::::::::	—	—	lxc

cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:* Versions — — ·lxc

Remediation

Fix · CNA incus (lxc) Fixed in 7.1.0
Fix · GHSA-xhqx-mgh3-3h7q github.com/lxc/incus/v7/cmd/incusd (Go) Fixed in 7.1.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-48756
2026-10-03 Alias added: GHSA-xhqx-mgh3-3h7q

References

Other 2

TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
TI-2026-45063 Incus vulnerable to root RCE via image backup.yaml symlink CVSS 3.1CRITICAL 9.9
TI-2026-44978 Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge CVSS 3.1CRITICAL 9.9
TI-2026-36039 Incus has an arbitrary file write on its client due to trusted image hash CVSS 3.1CRITICAL 9.9
TI-2026-36024 Incus has an arbitrary file write via path traversal in S3 multipart upload CVSS 3.1CRITICAL 9.9
TI-2026-36022 Incus has a restricted project bypass leading to arbitrary command execution CVSS 3.1CRITICAL 9.9

See all 63 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences