CVE-2026-48754— Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
Quick assessment
Affected
lxc incus
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Incus 是一个系统容器和虚拟机管理器。在版本 7.1.0 之前， 文件中的 函数存在多处未加防护的指针解引用问题，具体发生在处理每个依赖卷条目（dependent-volume entry）的 、 和 子字段时。拥有任意项目 权限的已认证用户，可以通过上传一个实例备份 tarball 文件，其中 块包含 nil 快照指针（或省略 / 字段），从而导致 守护进程崩溃。该漏洞是 2026-05-04 批次修复提交 （标题为“正确检查导入时的依赖卷”）所解决问题的“同辈字段变体”。该提交在外部循环顶部添加了 检查，但
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-48754
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
Source: CVE Program / CVE List V5
Vulnerability Description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry's `VolumeSnapshots[i]`, `Volume`, and `Pool` sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch fix `d768f81c0a1d985f35ae56219519822b080bf5e3` ("Properly check dependent volumes on import"). That commit added `if disk == nil` at the top of the outer loop, but did not guard the four sub-pointer fields the loop body dereferences naked. Version 7.1.0 contains an updated patch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-48754
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48754
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-48754 (1)
Same Patch Batch · lxc · 2026-08-21 · 18 CVEs total
| CVE-2026-62940 | 9.9 CRITICAL | Incus has a project restriction bypass via instance migration config override |
| CVE-2026-63343 | 9.9 CRITICAL | Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as |
| CVE-2026-63125 | 9.9 CRITICAL | Incus vulnerable to root RCE via image backup.yaml symlink |
| CVE-2026-48769 | 9.9 CRITICAL | Incus has an arbitrary file write on its client due to trusted image hash |
| CVE-2026-48755 | 9.9 CRITICAL | Incus has an argument injection in backup compression algorithm leading to AFW and ACE |
| CVE-2026-62867 | 9.9 CRITICAL | Incus has an argument injection in storage volume block.create_options that leads to arbit |
| CVE-2026-62941 | 9.9 CRITICAL | Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in conf |
| CVE-2026-48752 | 9.9 CRITICAL | Incus has arbitrary file read+write on host via templates/ symlink in malicious image |
| CVE-2026-48751 | 9.9 CRITICAL | Incus has a restricted project bypass leading to arbitrary command execution |
| CVE-2026-48753 | 9.9 CRITICAL | Incus has an arbitrary file write via path traversal in S3 multipart upload |
| CVE-2026-48749 | 9.9 CRITICAL | Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image |
| CVE-2026-48750 | 9.9 CRITICAL | Incus has an arbitrary file write on host via `exec-output` symlink in crafted image |
| CVE-2026-55621 | 7.7 HIGH | Incus has a project restriction bypass for custom volume copy across projects |
| CVE-2026-55622 | 7.7 HIGH | Incus has a project restriction bypass in instance copy across projects |
| CVE-2026-47753 | 4.4 MEDIUM | Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) |
| CVE-2026-62313 | 4.3 MEDIUM | Incus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitti |
| CVE-2026-48756 | 2.1 LOW | Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires |
IV. Related Vulnerabilities
Same product: incus
-
CVE-2026-63343
Arbitrary File Read/Write: metadata.yaml symlink in image al -
CVE-2026-63125
Incus vulnerable to root RCE via image backup.yaml symlink -
CVE-2026-62941
Incus: Cross-project instance copy bypasses target project r -
CVE-2026-62940
Incus has a project restriction bypass via instance migratio -
CVE-2026-62867
Incus has an argument injection in storage volume block.crea
Same vendor: lxc
-
CVE-2026-63343
Arbitrary File Read/Write: metadata.yaml symlink in image al -
CVE-2026-63125
Incus vulnerable to root RCE via image backup.yaml symlink -
CVE-2026-62941
Incus: Cross-project instance copy bypasses target project r -
CVE-2026-62940
Incus has a project restriction bypass via instance migratio -
CVE-2026-62867
Incus has an argument injection in storage volume block.crea
Same weakness: CWE-476
-
CVE-2026-78148
ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_comput -
CVE-2026-76905
kin-openapi openai3filter: nil-pointer panic in ConvertError -
CVE-2026-17251
Unauthenticated Denial of Service via Null Pointer Dereferen -
CVE-2026-47753
Incus has a Nil-Pointer Dereference Panic via Instance Backu -
CVE-2026-48756
Incus: CreateCustomVolumeFromBackup nil-pointer dereference
V. Comments for CVE-2026-48754
No comments yet