CVE-2026-41647
published 2026-05-07CVE-2026-41647: Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.39%
31.6th percentile
Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | lxc_incus_v6_cmd_incusd | 0 – 6.23.0 | — |
| linuxcontainers | incus | < 7.0.0 | 7.0.0 |
| lxc | incus | < 7.0.0 | 7.0.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
lxc incus up to 6.x Backup File null pointer dereference (GHSA-fwj8-62r8-8p8m)
vuldb·2026-05-07·CVSS 6.5
CVE-2026-41647 [MEDIUM] lxc incus up to 6.x Backup File null pointer dereference (GHSA-fwj8-62r8-8p8m)
A vulnerability identified as problematic has been detected in lxc incus up to 6.x. Affected by this vulnerability is an unknown functionality of the component Backup File Handler. This manipulation causes null pointer dereference.
This vulnerability is tracked as CVE-2026-41647. The attack is possible to be carried out remotely. No exploit exists.
You should upgrade the affected component.
GHSA
Incus has Nil-Pointer Dereference via S3 Bucket Import
ghsa·2026-05-04
CVE-2026-41647 [MEDIUM] CWE-476 Incus has Nil-Pointer Dereference via S3 Bucket Import
Incus has Nil-Pointer Dereference via S3 Bucket Import
### Summary
Missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file.
### Details
It was found that TransferManager.UploadAllFiles iterates over tar entries but only checks for io.EOF from tr.Next(). When tr.Next() returns a non-EOF error, such as unexpected EOF from a truncated archive, the header hdr is nil and the code continues to access hdr.Name, causing a nil-pointer dereference that panics the daemon.
This may allow the Incus daemon to be crashed during S3 bucket restore if a truncated or corrupted backup archive is provided. A panic can occur when a malformed archive produces a non-EOF tar read error after the first entry. Any caller of
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-41647 incus: Incus: Denial of Service via truncated storage bucket backup file import [fedora-all]
bugzilla·2026-05-12·CVSS 6.5
CVE-2026-41647 [MEDIUM] CVE-2026-41647 incus: Incus: Denial of Service via truncated storage bucket backup file import [fedora-all]
CVE-2026-41647 incus: Incus: Denial of Service via truncated storage bucket backup file import [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41647 Incus: Incus: Denial of Service via truncated storage bucket backup file import
bugzilla·2026-05-07·CVSS 6.5
CVE-2026-41647 [MEDIUM] CVE-2026-41647 Incus: Incus: Denial of Service via truncated storage bucket backup file import
CVE-2026-41647 Incus: Incus: Denial of Service via truncated storage bucket backup file import
Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0.
2026-05-07
Published