CVE-2026-40195 in incus
Summary
by MITRE • 05/07/2026
Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup metadata handling logic, where the daemon processes the index.yaml file from an imported archive and accesses members of the parsed backup configuration without first verifying that the configuration object was initialized. A malicious or malformed index.yaml that omits the config block causes a nil-pointer dereference during bucket import operations and terminates the daemon. Repeated use of this issue can be used to keep Incus offline, causing a denial of service. This issue is fixed in version 7.0.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/03/2026
The vulnerability exists within Incus version 7.0.0 and earlier, where insufficient validation logic in storage bucket import functionality creates a critical crash condition for the daemon. This flaw specifically affects authenticated users who possess access to the storage bucket feature, making it exploitable by individuals with legitimate credentials. The root cause lies in the backup metadata handling process where the daemon parses index.yaml files from imported archives without proper initialization checks. When processing these archive files, the system accesses configuration object members without first verifying that the configuration object was properly initialized, creating a dangerous state that leads to nil-pointer dereference conditions.
The technical exploitation occurs during bucket import operations when the daemon encounters a malicious or malformed index.yaml file that deliberately omits the config block. This omission triggers an uninitialized memory access pattern that causes the Incus daemon to terminate abruptly. The vulnerability represents a classic implementation flaw where defensive programming practices are insufficiently applied, leading to a direct denial of service condition. According to CWE-476, this manifests as a null pointer dereference, while the ATT&CK framework would categorize this under privilege escalation and denial of service techniques.
The operational impact of this vulnerability extends beyond simple daemon crashes, as repeated exploitation can maintain Incus in an offline state indefinitely. This persistent disruption creates significant service availability issues for organizations relying on container and virtual machine management capabilities. The authenticated nature of the attack means that internal threats or compromised accounts could leverage this weakness to systematically disable critical infrastructure services. Organizations using affected versions face potential operational downtime that could span hours or days depending on recovery procedures.
Mitigation strategies should prioritize immediate upgrade to Incus version 7.0.0 or later, which contains the necessary validation logic fixes. Additionally, administrators should implement monitoring for unusual bucket import activities and consider restricting access to storage bucket features for users who do not require such privileges. The fix addresses the fundamental initialization check that was missing in earlier versions, ensuring that configuration objects are properly validated before any member access occurs. This remediation aligns with secure coding practices recommended by both CWE guidelines and industry best practices for preventing null pointer dereference conditions in daemon processes handling external input data.