CVE-2025-52890
published 2025-06-25CVE-2025-52890: Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables…
PriorityP338high8.1CVSS 3.1
AVAACLPRHUINSCCHINAH
EPSS
0.19%
9.4th percentile
Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | incus | — | — |
| github.com | lxc_incus_v6 | >= 6.12.0 < 6.14.0 | 6.14.0 |
| lxc | incus | — | — |
| msrc | azl3_ntfs-3g_2022.10.3-2_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_ntfs-3g_2022.10.3-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
osv8.1HIGH
vendor_debian8.1LOW
vendor_msrc4.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Incus creates nftables rules that partially bypass security options in github.com/lxc/incus
osv·2025-07-28
CVE-2025-52890 Incus creates nftables rules that partially bypass security options in github.com/lxc/incus
Incus creates nftables rules that partially bypass security options in github.com/lxc/incus
Incus creates nftables rules that partially bypass security options in github.com/lxc/incus
OSV
Incus creates nftables rules that partially bypass security options
osv·2025-06-26
CVE-2025-52890 [HIGH] Incus creates nftables rules that partially bypass security options
Incus creates nftables rules that partially bypass security options
### Summary
When using an ACL on a device connected to a bridge, Incus generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge.
### Details
In commit d137a063c2fe2a6983c995ba75c03731bee1557d, a few rules in the bridge input chain are moved to the top of the chain:
ct state established,related accept
iifname "{{.hostName}}" ether type arp accept
iifname "{{.hostName}}" ip6 nexthdr ipv6-icmp icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } accept
However, these rules accept packets that should be filtered and maybe dropp
GHSA
Incus creates nftables rules that partially bypass security options
ghsa·2025-06-26
CVE-2025-52890 [HIGH] CWE-863 Incus creates nftables rules that partially bypass security options
Incus creates nftables rules that partially bypass security options
### Summary
When using an ACL on a device connected to a bridge, Incus generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge.
### Details
In commit d137a063c2fe2a6983c995ba75c03731bee1557d, a few rules in the bridge input chain are moved to the top of the chain:
ct state established,related accept
iifname "{{.hostName}}" ether type arp accept
iifname "{{.hostName}}" ip6 nexthdr ipv6-icmp icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } accept
However, these rules accept packets that should be filtered and maybe dropp
OSV
CVE-2025-52890: Incus is a system container and virtual machine manager
osv·2025-06-25·CVSS 8.1
CVE-2025-52890 [HIGH] CVE-2025-52890: Incus is a system container and virtual machine manager
Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue.
Debian
CVE-2025-52890: incus - Incus is a system container and virtual machine manager. When using an ACL on a ...
vendor_debian·2025·CVSS 8.1
CVE-2025-52890 [HIGH] CVE-2025-52890: incus - Incus is a system container and virtual machine manager. When using an ACL on a ...
Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue.
Scope: local
forky: resolved
sid: resolved
trixie: resolved
Microsoft
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
vendor_msrc·2024-06-11·CVSS 4.5
CVE-2023-52890 [MEDIUM] NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
NTFS-3G before 75dcdc2 has a use-after-free in ntfs_uppercase_mbs in libntfs-3g/unistr.c. NOTE: discussion suggests that exploitation would be challenging.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
mitr
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-06-25
Published