Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-41684: Incus backup restore can crash daemon
CVE-2026-41684 · published 6 months ago
Summary
Versions of Incus and LXD before 7.0.0 may let a specially crafted backup file cause the management service to stop working. An attacker with permission to import backups could trigger the crash by providing a malformed backup archive. Upgrade to version 7.0.0 or later to prevent this issue.
What to do
- Update debian incus to version 6.0.4-2+deb13u7.
- Update debian lxd to version 5.0.2-5+deb12u6.
- Update debian lxd to version 5.0.2+git20231211.1364ae4-9+deb13u6.
- Update linuxcontainers incus to version 7.0.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | incus |
< 6.0.4-2+deb13u7 Fix: upgrade to 6.0.4-2+deb13u7
|
| Debian:14 | debian | incus | All versions |
| go | github.com | lxc | <= 6.23.0 |
| Debian:12 | debian | lxd |
< 5.0.2-5+deb12u6 Fix: upgrade to 5.0.2-5+deb12u6
|
| Debian:13 | debian | lxd |
< 5.0.2+git20231211.1364ae4-9+deb13u6 Fix: upgrade to 5.0.2+git20231211.1364ae4-9+deb13u6
|
| Ubuntu:Pro:16.04:LTS | canonical | lxd | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | incus | All versions |
| – | linuxcontainers | incus |
< 7.0.0 cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:* |
Original advisory text
Incus: Nil Dereferences on Restore via Malformed YAML
Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo() trusts the inline backup/index.yaml config when present and only falls back to parsing the legacy backup/container/backup.yaml file if result.Config == nil. As a result, an archive can carry a valid inline config that passes the initial import preflight while also carrying a malformed legacy backup/container/backup.yaml file that is reparsed later from the restored file system. ParseConfigYamlFile() accepts YAML documents with no container section, and multiple downstream consumers then dereference. Container without checking for nil. Confirmed examples in the instance restore and import flow include backup.UpdateInstanceConfig() and internalImportFromBackup(). An authenticated user with permission to import instance backups may be able to crash the Incus daemon with a crafted backup archive whose inline backup/index.yaml is valid but whose extracted legacy backup.yaml omits container. The crash occurs in the restore path after archive extraction has begun. This issue has been patched in version 7.0.0.
References
- https://security-tracker.debian.org/tracker/CVE-2026-41684 Vendor Advisory
- https://github.com/lxc/incus/releases/tag/v7.0.0 Patch Product
- https://github.com/lxc/incus/security/advisories/GHSA-x5r6-jr56-89pv Exploit Mitigation Vendor Advisory
- https://github.com/advisories/GHSA-x5r6-jr56-89pv
- https://nvd.nist.gov/vuln/detail/CVE-2026-41684 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41684... Vendor Advisory
- https://ubuntu.com/security/CVE-2026-41684 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-41684 Third Party Advisory
- https://github.com/lxc/incus/pull/3273 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-476NULL Pointer Dereference
Timeline
Published7 May 2026
Updated4 Nov 2026
First seen1 May 2026
Sources
DEBIAN-CVE-2026-41684 · OSV
GHSA-x5r6-jr56-89pv · GHSA
CVE-2026-41684 · NVD
UBUNTU-CVE-2026-41684 · OSV
CVE-2026-41684 · OSV
Track software like this
Free during beta