The Incus daemon (incusd) contains a vulnerability in the CreateCustomVolumeFromBackup function within internal/server/storage/backend.go. The function dereferences the ExpiresAt field, a pointer to time.Time, of each volume snapshot without verifying it is non-nil. This leads to a runtime panic if the expires_at field is omitted in the uploaded backup's volume_snapshots YAML. An attacker with the can_create_storage_volumes entitlement can exploit this by uploading a malicious custom volume backup tarball, causing the incusd process to crash and resulting in a persistent denial of service. This issue is a sibling-field variant of a previously known vulnerability (GHSA-r7w7, CVE-2026-40197).

Exploitation causes the incusd daemon to panic and crash due to an unhandled nil pointer dereference. This results in a denial of service condition where the storage volume creation service is unavailable until the daemon is restarted. The vulnerability requires authenticated access with specific permissions, limiting the attack surface. There is no indication of code execution or data corruption beyond service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users with the can_create_storage_volumes entitlement to trusted personnel only. Avoid uploading custom volume backups that omit the expires_at field in volume snapshots. Monitor vendor communications for an official fix or update that adds proper nil checks to prevent the panic.