Lxd: [Unknown description] (CVE-2026-48756)
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with `can_create_storage_volumes` permission on any project can crash the `incusd` daemon by uploading a backup tarball whose `volume_snapshots[*].expires_at` field is absent. This is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). Commit `985a1dedf9f3e7ba729c93b654905ed510de25c2` added `if s == nil` at the top of the loop body, but did not guard the adjacent `*snapshot.ExpiresAt` deref 19 lines later. Every other consumer of `Config.VolumeSnapshots[i].ExpiresAt` in this same file already gates the deref with a nil-check — the asymmetric guard is the bug. Version 7.1.0 contains an updated patch.
AI Analysis
Technical Summary
The Incusd daemon in Incus versions before 7.1.0 has a bug in the internal/server/storage/backend.go file in the CreateCustomVolumeFromBackup method. This method dereferences the ExpiresAt pointer of volume snapshot entries without a proper nil check, leading to a nil-pointer dereference if the expires_at field is missing in the backup data. This can be triggered by an authenticated user with can_create_storage_volumes permission by uploading a specially crafted backup tarball, causing the daemon to crash. The issue is a variant of a previously known vulnerability (GHSA-r7w7, CVE-2026-40197). The patch in version 7.1.0 adds the necessary nil check to prevent the crash.
Potential Impact
An authenticated user with permission to create storage volumes can cause the incusd daemon to crash by uploading a backup tarball with missing expires_at fields in volume snapshots. This results in a denial of service condition affecting the availability of the incusd service. No privilege escalation, code execution, or data corruption is indicated.
Mitigation Recommendations
Upgrade to Incus version 7.1.0 or later, which contains the official fix that adds the missing nil-pointer check to prevent the crash. Until upgraded, restrict the ability to create storage volumes to trusted users only to reduce risk.
Lxd: [Unknown description] (CVE-2026-48756)
Description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with `can_create_storage_volumes` permission on any project can crash the `incusd` daemon by uploading a backup tarball whose `volume_snapshots[*].expires_at` field is absent. This is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). Commit `985a1dedf9f3e7ba729c93b654905ed510de25c2` added `if s == nil` at the top of the loop body, but did not guard the adjacent `*snapshot.ExpiresAt` deref 19 lines later. Every other consumer of `Config.VolumeSnapshots[i].ExpiresAt` in this same file already gates the deref with a nil-check — the asymmetric guard is the bug. Version 7.1.0 contains an updated patch.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Incusd daemon in Incus versions before 7.1.0 has a bug in the internal/server/storage/backend.go file in the CreateCustomVolumeFromBackup method. This method dereferences the ExpiresAt pointer of volume snapshot entries without a proper nil check, leading to a nil-pointer dereference if the expires_at field is missing in the backup data. This can be triggered by an authenticated user with can_create_storage_volumes permission by uploading a specially crafted backup tarball, causing the daemon to crash. The issue is a variant of a previously known vulnerability (GHSA-r7w7, CVE-2026-40197). The patch in version 7.1.0 adds the necessary nil check to prevent the crash.
Potential Impact
An authenticated user with permission to create storage volumes can cause the incusd daemon to crash by uploading a backup tarball with missing expires_at fields in volume snapshots. This results in a denial of service condition affecting the availability of the incusd service. No privilege escalation, code execution, or data corruption is indicated.
Mitigation Recommendations
Upgrade to Incus version 7.1.0 or later, which contains the official fix that adds the missing nil-pointer check to prevent the crash. Until upgraded, restrict the ability to create storage volumes to trusted users only to reduce risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xhqx-mgh3-3h7q
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-48756"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6a3ef78d27e9c79719ff4948
Added to database: 06/26/2026, 22:05:01 UTC
Last enriched: 08/22/2026, 11:07:03 UTC
Last updated: 09/13/2026, 04:52:44 UTC
Views: 99
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.