CVE-2026-41647 is a vulnerability in the Incus daemon where missing error handling during S3 bucket import can cause a nil-pointer dereference and crash the daemon. This occurs when a truncated or corrupted tar archive is processed, leading to a panic due to dereferencing a nil header pointer. The issue affects versions up to 6.23.0 and has a medium severity rating with an impact on availability.