The vulnerability is a nil-pointer dereference in the createDependentVolumesFromBackup function within internal/server/storage/backend.go of the Incus project. The function iterates over dependent volumes in a backup's config and dereferences sub-fields VolumeSnapshots[i], Volume, and Pool without checking for nil values. An attacker with authenticated access and can_create_instances permission can craft a backup tarball with dependent volumes containing nil snapshot pointers or missing volume or pool fields, triggering a panic in the daemon. This leads to a crash of incusd and persistent denial of service. The issue arises because the existing fix only checked the outer disk pointer for nil but did not guard nested pointers. The vulnerability affects versions before 7.1.0.

An authenticated attacker with can_create_instances permission can cause the incusd daemon to crash by submitting a malicious instance backup containing malformed dependent volume entries. This results in a persistent denial of service condition, disrupting service availability. There is no indication of privilege escalation or data corruption beyond the crash. The severity is low due to the requirement for authenticated access and the impact limited to denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict can_create_instances permission to trusted users only to reduce risk. Monitor for daemon crashes and avoid importing untrusted backup tarballs with dependent volumes. No official patch links are provided in the current data.