{"id":"CVE-2026-48754","sourceIdentifier":"security-advisories@github.com","published":"2026-08-21T15:16:40.943","lastModified":"2026-10-15T19:10:00.173","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry's `VolumeSnapshots[i]`, `Volume`, and `Pool` sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch fix `d768f81c0a1d985f35ae56219519822b080bf5e3` (\"Properly check dependent volumes on import\"). That commit added `if disk == nil` at the top of the outer loop, but did not guard the four sub-pointer fields the loop body dereferences naked. Version 7.1.0 contains an updated patch."},{"lang":"es","value":"Incus es un gestor de contenedores de sistema y máquinas virtuales. Antes de la versión 7.1.0, '(backend).createDependentVolumesFromBackup' en 'internal/server/storage/backend.go' contiene un grupo de desreferencias de puntero sin protección en los subcampos 'VolumeSnapshots[i]', 'Volume' y 'Pool' de cada entrada de volumen dependiente. Un usuario autenticado con permiso 'can_create_instances' en cualquier proyecto puede bloquear el demonio 'incusd' al subir un tarball de copia de seguridad de instancia cuyo bloque 'dependent_volumes[*]' contiene un puntero de instantánea nulo (o omite 'volume:' / 'pool:'). Esta es una variante de campo hermano de la corrección por lotes del 04-05-2026 'd768f81c0a1d985f35ae56219519822b080bf5e3' ('Comprobar correctamente los volúmenes dependientes en la importación'). Ese commit añadió 'if disk == nil' al principio del bucle exterior, pero no protegió los cuatro campos de subpuntero que el cuerpo del bucle desreferencia directamente. La versión 7.1.0 contiene un parche actualizado."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"lxc","product":"incus","versions":[{"version":"< 7.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-26T17:25:43.772920Z","id":"CVE-2026-48754","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/lxc/incus/security/advisories/GHSA-4xg6-52mh-fpw8","source":"security-advisories@github.com"},{"url":"https://github.com/lxc/incus/security/advisories/GHSA-4xg6-52mh-fpw8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}