{"id":"EUVD-2026-63981","enisaUuid":"54b54e62-8d1f-3124-abbd-9d3624102e84","description":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry\u0027s `VolumeSnapshots[i]`, `Volume`, and `Pool` sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch fix `d768f81c0a1d985f35ae56219519822b080bf5e3` (\"Properly check dependent volumes on import\"). That commit added `if disk \u003d\u003d nil` at the top of the outer loop, but did not guard the four sub-pointer fields the loop body dereferences naked. Version 7.1.0 contains an updated patch.","datePublished":"Aug 21, 2026, 2:36:16 PM","dateUpdated":"Aug 26, 2026, 5:26:19 PM","baseScore":2.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","references":"https://github.com/lxc/incus/security/advisories/GHSA-4xg6-52mh-fpw8\n","aliases":"CVE-2026-48754\nGHSA-4xg6-52mh-fpw8\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"24b9ec43-740e-32fd-83c7-4878df2665ce","product":{"name":"incus","vendor":{"name":"lxc"}},"product_version":"\u003c 7.1.0"}],"enisaIdVendor":[{"id":"ffc455d1-c018-3d2c-ba59-d17e1d28fd99","vendor":{"name":"lxc"}}],"enisaIdVulnerability":[{"id":"8799bd67-3790-3973-97a9-470c4e778773","vulnerability":{"id":"GHSA-4xg6-52mh-fpw8","description":"Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}","datePublished":"Jun 26, 2026, 6:52:46 PM","dateUpdated":"Jun 26, 2026, 6:52:46 PM","baseScore":0.0,"references":"https://github.com/lxc/incus/security/advisories/GHSA-4xg6-52mh-fpw8\nhttps://github.com/lxc/incus\n","enisa_id":"EUVD-2026-63981\n","aliases":"GHSA-4xg6-52mh-fpw8\nCVE-2026-48754\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f08a21c3-0e3f-38c0-adb3-c9e0953cd486","vulnerability":{"id":"CVE-2026-48754","description":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry\u0027s `VolumeSnapshots[i]`, `Volume`, and `Pool` sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch fix `d768f81c0a1d985f35ae56219519822b080bf5e3` (\"Properly check dependent volumes on import\"). That commit added `if disk \u003d\u003d nil` at the top of the outer loop, but did not guard the four sub-pointer fields the loop body dereferences naked. Version 7.1.0 contains an updated patch.","datePublished":"Aug 21, 2026, 2:36:16 PM","dateUpdated":"Aug 26, 2026, 5:26:19 PM","status":"PUBLISHED","baseScore":2.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","references":"https://github.com/lxc/incus/security/advisories/GHSA-4xg6-52mh-fpw8\n","enisa_id":"EUVD-2026-63981\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Nov 5, 2026, 7:19:12 AM","vulnerabilityProduct":[{"id":"41900d39-b685-3829-950f-adfc84c2de3f","product":{"name":"incus","vendor":{"name":"lxc"}},"product_version":"\u003c 7.1.0"}],"vulnerabilityVendor":[{"id":"4db80cef-8aa0-3e26-90fe-4e22e7fd6ec3","vendor":{"name":"lxc"}}]}}],"enisaIdAdvisory":[{"id":"6bb58031-c0af-3467-aca4-d09100c1d976","advisory":{"id":"openSUSE-SU-2026:11651-1","description":"incus-7.4-1.1 on GA media","summary":"incus-7.4-1.1 on GA media","datePublished":"Aug 31, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:22:13 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11651-1.json\nhttps://www.suse.com/security/cve/CVE-2026-39402/\nhttps://www.suse.com/security/cve/CVE-2026-47753/\nhttps://www.suse.com/security/cve/CVE-2026-48749/\nhttps://www.suse.com/security/cve/CVE-2026-48750/\nhttps://www.suse.com/security/cve/CVE-2026-48751/\nhttps://www.suse.com/security/cve/CVE-2026-48752/\nhttps://www.suse.com/security/cve/CVE-2026-48753/\nhttps://www.suse.com/security/cve/CVE-2026-48754/\nhttps://www.suse.com/security/cve/CVE-2026-48755/\nhttps://www.suse.com/security/cve/CVE-2026-48756/\nhttps://www.suse.com/security/cve/CVE-2026-48769/\nhttps://www.suse.com/security/cve/CVE-2026-55621/\nhttps://www.suse.com/security/cve/CVE-2026-55622/\nhttps://www.suse.com/security/cve/CVE-2026-62313/\nhttps://www.suse.com/security/cve/CVE-2026-62867/\nhttps://www.suse.com/security/cve/CVE-2026-62940/\nhttps://www.suse.com/security/cve/CVE-2026-62941/\nhttps://www.suse.com/security/cve/CVE-2026-63125/\nhttps://www.suse.com/security/cve/CVE-2026-63343/\nhttps://www.suse.com/security/cve/CVE-2026-81500/\nhttps://www.suse.com/security/cve/CVE-2026-81501/\n","aliases":"CVE-2026-39402\nCVE-2026-47753\nCVE-2026-48749\nCVE-2026-48750\nCVE-2026-48751\nCVE-2026-48752\nCVE-2026-48753\nCVE-2026-48754\nCVE-2026-48755\nCVE-2026-48756\nCVE-2026-48769\nCVE-2026-55621\nCVE-2026-55622\nCVE-2026-62313\nCVE-2026-62867\nCVE-2026-62940\nCVE-2026-62941\nCVE-2026-63125\nCVE-2026-63343\nCVE-2026-81500\nCVE-2026-81501\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"03a17789-c710-3b17-9460-16163591d93f","product":{"name":"incus-tools-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"0437571b-35b8-3eec-b808-726d5ffcde2a","product":{"name":"incus-cli-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"055e79ea-486e-3c05-98f8-35197166b6cd","product":{"name":"incus-cli-zsh-completion-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"06b12a41-b007-3090-86c7-5aa3eec20eb8","product":{"name":"incus-tools-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"29c90d22-e153-3fc3-95b8-6edc33a33b76","product":{"name":"incus-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"31c4580e-6ad3-39d6-b665-224d84287177","product":{"name":"incus-cli-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4b7a8928-b8aa-3773-855c-6880bbaab457","product":{"name":"incus-cli-fish-completion-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"667eafc2-5107-3083-a29c-2ea312423cf1","product":{"name":"incus-cli-bash-completion-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"71c4e5a6-7c79-3f6a-a670-efce312e7775","product":{"name":"incus-cli-zsh-completion-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"778ffed4-fd86-3888-b1e8-a91cd0e5294d","product":{"name":"incus-cli-bash-completion-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7b39a356-718a-37e2-aac4-2cbf349d558a","product":{"name":"incus-cli-fish-completion-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"8b05d619-a1a8-367d-a706-17664db33693","product":{"name":"incus-cli-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"8ef511e4-900c-3ea5-ae04-0fe047a8f63a","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"913203f9-c901-3c34-96f8-6db1c564151b","product":{"name":"incus-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"91c03075-af87-36f2-b8e9-7d5f1533aacb","product":{"name":"incus-tools-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"ab6ccc6f-660c-3880-a05d-e3b68a5c840c","product":{"name":"incus-cli-bash-completion-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b387857e-6a7f-352b-8810-2d1b348e32ff","product":{"name":"incus-cli-zsh-completion-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b6aaa0fd-1fd8-3d86-9f40-80729614d3f1","product":{"name":"incus-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c302e38c-fd12-30d4-95da-5c80bb3bf690","product":{"name":"incus-tools-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c489ed71-3ab8-3693-aaa1-93d441cc0989","product":{"name":"incus-cli-fish-completion-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"c54ff042-297e-3f89-b844-7b1cfc0ed49a","product":{"name":"incus-cli-bash-completion-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"cc244842-7b65-38ef-bd3a-d42275a18afb","product":{"name":"incus-cli-fish-completion-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"ce48a0e4-a973-3859-9948-b6b45721d92b","product":{"name":"incus-cli-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"d09dcf9a-9015-3724-8cda-13a869b8c222","product":{"name":"incus-cli-zsh-completion-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"de406327-2ca1-3139-8d56-ce19454d34a0","product":{"name":"incus-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}}]}}]}