CVE-2026-40251
Incus out-of-bounds panic in snapshot metadata handling allows denial of service
Description
Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays, and the same flawed pattern also appears in the migration path. When iterating through physical snapshots provided in a backup archive, the loop uses the index to look up corresponding metadata in the parsed `Config.Snapshots` and `Config.VolumeSnapshots` slices. The guard condition `len(slice) >= i-1` is incorrect because it can still evaluate to true when the subsequent slice[i] access is out of bounds. An attacker can submit a backup archive that contains physical snapshot directories while supplying a tampered `index.yaml` with an empty or truncated snapshot metadata array, causing the daemon to index beyond the end of the metadata slice and crash. Repeated use of this issue can be used to keep Incus offline, causing a denial of service. This issue is fixed in version 7.0.0.
INFO
Published Date :
May 6, 2026, 9:16 p.m.
Last Modified :
Oct. 26, 2026, 7:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update Incus to version 7.0.0 or later.
- Verify the integrity of imported storage volumes.
- Restrict access to storage volume features.
- Monitor Incus daemon for stability.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-40251.
| URL | Resource |
|---|---|
| https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go | Product |
| https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6 | Exploit Vendor Advisory |
| https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6 | Exploit Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-40251 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-40251
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-40251 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-40251 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: incus de lxc, Description: Incus es un gestor de contenedores de sistema y máquinas virtuales. En versiones anteriores a la 7.0.0, la lógica de validación faltante en la lógica de importación de volúmenes de almacenamiento permite a un usuario autenticado con acceso a la característica de volumen de almacenamiento provocar que el demonio de Incus falle. El subsistema de restauración de copias de seguridad contiene una vulnerabilidad de pánico por fuera de límites causada por una comprobación de límites inválida al indexar arreglos de metadatos de instantáneas, y el mismo patrón defectuoso también aparece en la ruta de migración. Al iterar a través de instantáneas físicas proporcionadas en un archivo de copia de seguridad, el bucle utiliza el índice para buscar metadatos correspondientes en las porciones “Config.Snapshots” y “Config.VolumeSnapshots” analizadas. La condición de guarda “len(slice) >= i-1” es incorrecta porque aún puede evaluarse como verdadera cuando el acceso subsiguiente a slice[i] está fuera de límites. Un atacante puede enviar un archivo de copia de seguridad que contiene directorios de instantáneas físicas mientras suministra un “index.yaml” manipulado con un arreglo de metadatos de instantáneas vacío o truncado, lo que provoca que el demonio indexe más allá del final de la porción de metadatos y falle. El uso repetido de este problema puede utilizarse para mantener Incus fuera de línea, causando una denegación de servicio. Este problema está solucionado en la versión 7.0.0. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'lxc', 'product': 'incus', 'versions': [{'status': 'affected', 'version': '< 7.0.0'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-40251', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-05-07T13:52:30.597450Z'} -
Initial Analysis by [email protected]
May. 07, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CPE Configuration OR *cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:* versions up to (excluding) 7.0.0 Added Reference Type GitHub, Inc.: https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go Types: Product Added Reference Type CISA-ADP: https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6 Types: Exploit, Vendor Advisory Added Reference Type GitHub, Inc.: https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6 Types: Exploit, Vendor Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
May. 07, 2026
Action Type Old Value New Value Added Reference https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6 -
New CVE Received by [email protected]
May. 06, 2026
Action Type Old Value New Value Added Description Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays, and the same flawed pattern also appears in the migration path. When iterating through physical snapshots provided in a backup archive, the loop uses the index to look up corresponding metadata in the parsed `Config.Snapshots` and `Config.VolumeSnapshots` slices. The guard condition `len(slice) >= i-1` is incorrect because it can still evaluate to true when the subsequent slice[i] access is out of bounds. An attacker can submit a backup archive that contains physical snapshot directories while supplying a tampered `index.yaml` with an empty or truncated snapshot metadata array, causing the daemon to index beyond the end of the metadata slice and crash. Repeated use of this issue can be used to keep Incus offline, causing a denial of service. This issue is fixed in version 7.0.0. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-129 Added Reference https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go Added Reference https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6