CVE-2026-48754

Executive Summary

CVE-2026-48754 is a denial-of-service vulnerability in Incus, a system container and virtual machine manager. An authenticated user with can_create_instances permission on any project can crash the incusd daemon by uploading a crafted instance backup tarball containing unguarded nil pointers in the dependent_volumes block. The vulnerability affects all Incus versions prior to 7.1.0, and is attributed to incomplete pointer validation in the (*backend).createDependentVolumesFromBackup function located in internal/server/storage/backend.go. Successful exploitation results in a denial-of-service condition affecting all tenants and workloads managed by the target Incus instance.

Technical Analysis

The vulnerability resides in the createDependentVolumesFromBackup method (defined on the *backend type) within internal/server/storage/backend.go. This function processes the dependent_volumes section of an uploaded instance backup tarball. The code iterates over each dependent-volume entry and performs multiple pointer dereferences on sub-fields — specifically VolumeSnapshots[i], Volume, and Pool — without prior nil-checks.

The vulnerability is described as a sibling-field variant of a previously addressed bug. A prior patch (commit d768f81c0a1d985f35ae56219519822b080bf5e3, dated 2026-05-04) added a single guard (if disk == nil) at the top of the outer loop. However, that patch failed to guard the four sub-pointer fields that the loop body dereferences without checking for nil. This incomplete fix left the code vulnerable to a cluster of unguarded pointer dereferences.

Attack mechanism at the class level (CWE-476 — NULL Pointer Dereference): When a Go program dereferences a nil pointer, the runtime panics. In a daemon process like incusd, this panic is typically not recovered, causing the process to terminate. The specific triggering conditions are:

1. An attacker authenticates with can_create_instances permission on any project.
2. The attacker crafts an instance backup tarball where the dependent_volumes[*] block includes:
   • A nil snapshot pointer (in the VolumeSnapshots[i] field), OR
   • Omits the volume: field, resulting in a nil Volume pointer, OR
   • Omits the pool: field, resulting in a nil Pool pointer.
3. Upon upload, the parser populates the dependent-volume structure with nil sub-fields, and the loop body dereferences them without guards, causing a panic and daemon crash.

Attack surface: The backup import/upload functionality is exposed over the Incus API to authenticated users. The permission boundary (can_create_instances) is assigned per-project, meaning a user with this permission in any project — even a low-privileged or isolated project — can exploit the flaw to take down the entire daemon.

Patch analysis: Version 7.1.0 contains an updated patch that addresses the missing sub-pointer guards. The patch confidence is rated 3/4 (LIKELY), confirmed by two independent sources (including Debian packaging).

Exploitation Scenarios

Note: No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-476) and the precise code-level description provided in the NVD metadata.

1. Reconnaissance / Target identification: An attacker with valid credentials (or who has obtained them via credential stuffing, phishing, or prior compromise) identifies an Incus deployment. Attackers may use SHODAN-style search for exposed Incus API endpoints (default port 8443) to locate targets. The attacker must have an account with can_create_instances permission in at least one project.

2. Triggering the flaw: The attacker crafts a malicious instance backup tarball. The tarball must contain a dependent_volumes block with at least one entry where:

   • A snapshot pointer is nil (i.e., the snapshot array contains a null element), or
   • The volume: field is omitted, or
   • The pool: field is omitted.

3. Payload / execution method: The attacker uploads the crafted tarball through the instance backup import API endpoint. The incusd daemon parses the backup, invokes (*backend).createDependentVolumesFromBackup, and the unguarded pointer dereference triggers a Go runtime panic. Since daemon processes typically do not recover from such panics in this code path, the process crashes.

4. Post-exploitation impact: The crash of incusd results in a complete denial of service. All containers, virtual machines, and management operations become unavailable. Depending on how the daemon is managed (e.g., systemd with restart policy), the daemon may restart, but an attacker can repeatedly re-upload the crafted tarball to maintain the denial-of-service condition. This constitutes an Endpoint Denial of Service attack (ATT&CK T1499).

Likely target profile: Multi-tenant Incus deployments where user isolation is relied upon, or any installation where less-privileged projects are granted to untrusted users. Even a single low-privilege project compromise is sufficient to take down the entire daemon, affecting all other tenants.

Impact Assessment

CVSS: No CVSS vector or score has been officially assigned (N/A).

Business impact:

• Availability: Complete loss of container/VM management and runtime operation. Any workload that depends on the Incus daemon being healthy (e.g., live migration, snapshot operations, inter-host communication) is affected.
• Confidentiality / Integrity: No direct impact identified from the vulnerability itself; the impact is limited to availability.
• Multi-tenancy risk: In a multi-tenant architecture, this is a cross-tenant denial-of-service. A user with minimal privileges in one project can crash the daemon for all tenants, violating isolation guarantees.

Affected systems: All Incus installations running versions prior to 7.1.0. This includes both standalone and clustered deployments. There is no known workaround that mitigates this vulnerability without patching (see Mitigation & Patch Guidance).

Blast radius: Entire server/cluster — the daemon is a centralized component; its crash affects all instances, users, and projects.

EPSS / CISA KEV: Not yet scored by FIRST.org. Not listed in CISA KEV. No known exploit-in-the-wild evidence.

Detection Guidance

The following detection rules target the exploitation of CVE-2026-48754. Since the flaw is triggered by uploading a crafted backup tarball with malformed dependent_volumes content, detection focuses on anomalous backup import events and associated daemon crashes (panic messages, process exits).

Sigma Rule

title: Incus Daemon Crash via Malicious Backup Upload (CVE-2026-48754)
id: 9f2a1f31-1c53-4f90-a6a2-2e6b9053d4a7
status: experimental
description: Detects repeated Incus daemon restarts following backup import operations, indicating possible exploitation of CVE-2026-48754 (unguarded nil pointer dereference).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-48754
author: Valtersit Threat Intelligence
date: 2026/06/05
logsource:
    category: process_creation
    product: linux
detection:
    selection_daemon:
        Image|endswith: '/incusd'
    selection_restart:
        CommandLine|contains:
            - 'restart'
            - 'daemon-reload'
    condition: selection_daemon and selection_restart
level: medium
falsepositives:
    - Legitimate daemon restarts during normal maintenance
    - Upgrades and configuration changes
tags:
    - attack.t1499
    - cve.2026.48754

YARA Rule

rule incus_backup_malicious_dependent_volumes
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect Incus backup tarballs containing nil or omitted dependent_volume sub-fields indicative of CVE-2026-48754 exploitation"
        cve = "CVE-2026-48754"
        date = "2026-06-05"
        severity = "high"
    strings:
        $dependent_volumes = "dependent_volumes" ascii wide
        $volume_key = "volume" ascii wide
        $pool_key = "pool" ascii wide
        $snapshot_key = "snapshots" ascii wide
    condition:
        $dependent_volumes and uint32(0) == 0x8B1F
}

Note: uint32(0) == 0x8B1F checks for gzip magic bytes (tar.gz). This rule flags backup files that contain dependent_volumes references; deeper YARA logic would require YARA 4.x with module support to parse the archive structure, which is beyond standard YARA capabilities. For robust detection, use the Elastic/Splunk rules below with file-integrity or API-log monitoring.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-48754 - Incus Backup Upload Attempt"; flow:to_server,established; http.uri; content:"backup"; http.method; content:"POST"; http.request_body; content:"dependent_volumes"; nocase; reference:cve,2026-48754; classtype:attempted-dos; sid:60000001; rev:1;)

Note: This rule detects HTTP POST requests to an endpoint containing "backup" in the URI, with body content referencing dependent_volumes. Adjust the URI pattern to match the actual Incus API path (e.g., /1.0/instances/.../backups/.../import) based on your deployment.

Elastic Detection

sequence with maxspan=5m
  [ process where event.action == "exec" and process.name == "incusd" and process.args in ("*restart*", "*reload*") ]
  [ file where event.action == "write" and file.name == "*.tar.gz" and file.path contains "backup" ]

Better EQL variant (daemon crash + backup import correlation):

sequence by host.name with maxspan=10m
  [ file where event.category == "file" and file.extension : ("tar.gz", "tgz")
    and file.path : ("*/backup*", "*backups*") ]
  [ process where event.category == "process" and process.name == "incusd"
    and process.exit_code != 0 and process.exit_code != null ]

Splunk SPL Query

index=linux_secure OR index=syslog
  (sourcetype=incusd:log OR sourcetype="incus:daemon")
  (("panic:" AND "nil pointer") OR ("SIGSEGV" AND "incusd"))
  OR
  (sourcetype=incus_api:access AND method=POST AND uri=*backup*)
| stats count by host, source, _time
| sort -count

Wazuh OSSEC Rule

<group name="incus,">
  <rule id="600001" level="12">
    <decoded_as>syslog</decoded_as>
    <match>incusd.*panic</match>
    <regex>runtime error: invalid memory address or nil pointer dereference</regex>
    <description>Incus daemon crashed with nil pointer dereference - possible CVE-2026-48754 exploitation</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>attack.dos,</group>
  </rule>

  <rule id="600002" level="8">
    <decoded_as>syslog</decoded_as>
    <match>incusd</match>
    <regex>failed to import backup</regex>
    <description>Incus backup import failure - possible CVE-2026-48754 attempt</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 — LIKELY. Two independent sources (Debian and upstream release) confirm the fix.

1. Immediate mitigations (if unable to patch immediately):

   • Restrict can_create_instances permission: Temporarily revoke this permission from untrusted or low-privilege users and projects. The vulnerability requires this permission to trigger.
   • Disable backup import: If backup import is not business-critical, disable or restrict it at the API/application level.
   • Network isolation: Restrict API access to trusted networks and endpoints only; do not expose the Incus API directly to the internet.
   • Rate limiting: Implement request rate limiting on the backup import endpoint to slow down repeated exploitation attempts.

2. Patch / upgrade steps:

   • Upgrade Incus to version 7.1.0 or later. This version contains the updated patch that guards all four sub-pointer fields.
   • For Debian-based deployments, apply the security update from the official Debian repository (patch sources confirm Debian availability).
   • Verify the upgrade by checking the daemon version and, if feasible, reviewing the specific code in internal/server/storage/backend.go for nil-checks on VolumeSnapshots[i], Volume, and Pool.

3. Long-term hardening:

   • Principle of least privilege: Audit project permission assignments. Ensure can_create_instances is granted only to trusted users and only where absolutely required.
   • Multi-tenancy isolation: If multi-tenant exposure is a requirement, consider running separate Incus instances per trust domain to limit the blast radius of a single-daemon crash.
   • Automated crash detection and recovery: Configure process supervisors (systemd Restart=on-failure) and alerting on daemon crashes. Integrate crash events into your SIEM (see detection rules above).
   • Code review practice: Given the incomplete-patch history, perform a code audit of the backup import parser for other unguarded pointer dereferences. Escalate any similar patterns to the vendor.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-48754
2. Incus Project (upstream): https://github.com/lxc/incus (release notes for version 7.1.0)
3. Debian Security Tracker: Debian package patch confirmation (CVE-2026-48754 entry)
4. Vendor fix commit (sibling variant): d768f81c0a1d985f35ae56219519822b080bf5e3 — "Properly check dependent volumes on import" (2026-05-04 batch fix)
5. CWE-476 (NULL Pointer Dereference): https://cwe.mitre.org/data/definitions/476.html

Threat actor / exploit-in-the-wild evidence: No known threat-actor campaigns, no public exploit code, no Nuclei template, and no CISA KEV listing are associated with this CVE at the time of writing. The PoC status is listed as Unknown/Private.