CVE-2026-41647 Details
Description
Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0.
A nil-pointer dereference vulnerability has been identified in Incus, a system container and virtual machine manager, in versions prior to 7.0.0. This vulnerability allows an authenticated user to cause a daemon crash by importing a truncated storage bucket backup file. The issue arises because the error handling for the tar file import is inadequate. When the import process encounters a non-end-of-file error from a truncated archive, it fails to properly check for errors before accessing the header information, leading to a dereference of a nil pointer and a subsequent crash of the daemon.
Users can upgrade to Incus version 7.0.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lxc/incus/releases/tag/v7.0.0 | [email protected] | PatchProduct |
| https://github.com/lxc/incus/security/advisories/GHSA-fwj8-62r8-8p8m | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxcontainers incus | < 7.0.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | Initial Analysis | [email protected] |
| May 7, 2026 | New CVE Received | [email protected] |