UnratedFix available

DEBIAN-CVE-2026-41684

Type: advisorySource: OSV1 source record

Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo() trusts the inline backup/index.yaml config when present and only falls back to parsing the legacy backup/container/backup.yaml file if result.Config == nil. As a result, an archive can carry a valid inline config that passes the initial import preflight while also carrying a malformed legacy backup/container/backup.yaml file that is reparsed later from the restored file system. ParseConfigYamlFile() accepts YAML documents with no container section, and multiple downstream consumers then dereference. Container without checking for nil. Confirmed examples in the instance restore and import flow include backup.UpdateInstanceConfig() and internalImportFromBackup(). An authenticated user with permission to import instance backups may be able to crash the Incus daemon with a crafted backup archive whose inline backup/index.yaml is valid but whose extracted legacy backup.yaml omits container. The crash occurs in the restore path after archive extraction has begun. This issue has been patched in version 7.0.0.

Announced 7 May 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-41684

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-41684

incus

Source reference: /affected/0/package/name

Affected versions: 6.0.4-2
Source reference: /affected/0/versions
6.0.4-2+deb13u1
Source reference: /affected/0/versions
6.0.4-2+deb13u1~bpo12+1
Source reference: /affected/0/versions
6.0.4-2+deb13u2
Source reference: /affected/0/versions
6.0.4-2+deb13u2~bpo12+1
Source reference: /affected/0/versions
6.0.4-2+deb13u3
Source reference: /affected/0/versions
6.0.4-2+deb13u3~bpo12+1
Source reference: /affected/0/versions
6.0.4-2+deb13u4
Source reference: /affected/0/versions
6.0.4-2+deb13u4~bpo12+1
Source reference: /affected/0/versions
6.0.4-2+deb13u5
Source reference: /affected/0/versions
6.0.4-2+deb13u5~bpo12+1
Source reference: /affected/0/versions
6.0.4-2+deb13u6
Source reference: /affected/0/versions
6.0.4-2+deb13u6~bpo12+1
Source reference: /affected/0/versions
6.0.4-2+deb13u7~bpo12+1
Source reference: /affected/0/versions
Fixed versions: 6.0.4-2+deb13u7
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

incus

Source reference: /affected/1/package/name

Affected versions: 6.0.4-2
Source reference: /affected/1/versions
6.0.4-3
Source reference: /affected/1/versions
6.0.5-1
Source reference: /affected/1/versions
6.0.5-2
Source reference: /affected/1/versions
6.0.5-3
Source reference: /affected/1/versions
6.0.5-4
Source reference: /affected/1/versions
6.0.5-5
Source reference: /affected/1/versions
6.0.5-6
Source reference: /affected/1/versions
6.0.5-7
Source reference: /affected/1/versions
6.0.5-8
Source reference: /affected/1/versions
6.0.6-1
Source reference: /affected/1/versions
6.0.6-2
Source reference: /affected/1/versions
6.0.6-3
Source reference: /affected/1/versions
6.14.0-1~exp1
Source reference: /affected/1/versions
6.15.0-1~exp1
Source reference: /affected/1/versions
6.16.0-1~exp1
Source reference: /affected/1/versions
6.17.0-1~exp1
Source reference: /affected/1/versions
6.20.0-1~exp1
Source reference: /affected/1/versions
6.21.0-1~exp1
Source reference: /affected/1/versions
6.22.0-1~exp1
Source reference: /affected/1/versions
6.23.0-1~exp1
Source reference: /affected/1/versions
7.0.0-1~bpo13+1
Source reference: /affected/1/versions
Fixed versions: 7.0.0-1
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

lxd

Source reference: /affected/2/package/name

Affected versions: 5.0.2+git20231211.1364ae4-1
Source reference: /affected/2/versions
5.0.2+git20231211.1364ae4-2
Source reference: /affected/2/versions
5.0.2+git20231211.1364ae4-3
Source reference: /affected/2/versions
5.0.2+git20231211.1364ae4-4
Source reference: /affected/2/versions
5.0.2+git20231211.1364ae4-5
Source reference: /affected/2/versions
5.0.2+git20231211.1364ae4-6
Source reference: /affected/2/versions
5.0.2+git20231211.1364ae4-7
Source reference: /affected/2/versions
5.0.2+git20231211.1364ae4-8
Source reference: /affected/2/versions
5.0.2+git20231211.1364ae4-9
Source reference: /affected/2/versions
5.0.2-5
Source reference: /affected/2/versions
5.0.2-5+deb12u1
Source reference: /affected/2/versions
5.0.2-5+deb12u2
Source reference: /affected/2/versions
5.0.2-5+deb12u3
Source reference: /affected/2/versions
5.0.2-5+deb12u4
Source reference: /affected/2/versions
5.0.2-5+deb12u5
Source reference: /affected/2/versions
5.0.2-5+deb12u6
Source reference: /affected/2/versions
5.0.2-6
Source reference: /affected/2/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

lxd

Source reference: /affected/3/package/name

Affected versions: 5.0.2+git20231211.1364ae4-9
Source reference: /affected/3/versions
5.0.2+git20231211.1364ae4-9+deb13u1
Source reference: /affected/3/versions
5.0.2+git20231211.1364ae4-9+deb13u2
Source reference: /affected/3/versions
5.0.2+git20231211.1364ae4-9+deb13u3
Source reference: /affected/3/versions
5.0.2+git20231211.1364ae4-9+deb13u4
Source reference: /affected/3/versions
5.0.2+git20231211.1364ae4-9+deb13u5
Source reference: /affected/3/versions
Fixed versions: 5.0.2+git20231211.1364ae4-9+deb13u6
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "6.0.4-2+deb13u7"
          }
        ]
      }
    ],
    "package": {
      "name": "incus",
      "purl": "pkg:deb/debian/incus?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "6.0.4-2",
      "6.0.4-2+deb13u1",
      "6.0.4-2+deb13u1~bpo12+1",
      "6.0.4-2+deb13u2",
      "6.0.4-2+deb13u2~bpo12+1",
      "6.0.4-2+deb13u3",
      "6.0.4-2+deb13u3~bpo12+1",
      "6.0.4-2+deb13u4",
      "6.0.4-2+deb13u4~bpo12+1",
      "6.0.4-2+deb13u5",
      "6.0.4-2+deb13u5~bpo12+1",
      "6.0.4-2+deb13u6",
      "6.0.4-2+deb13u6~bpo12+1",
      "6.0.4-2+deb13u7~bpo12+1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41684.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "7.0.0-1"
          }
        ]
      }
    ],
    "package": {
      "name": "incus",
      "purl": "pkg:deb/debian/incus?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "6.0.4-2",
      "6.0.4-3",
      "6.0.5-1",
      "6.0.5-2",
      "6.0.5-3",
      "6.0.5-4",
      "6.0.5-5",
      "6.0.5-6",
      "6.0.5-7",
      "6.0.5-8",
      "6.0.6-1",
      "6.0.6-2",
      "6.0.6-3",
      "6.14.0-1~exp1",
      "6.15.0-1~exp1",
      "6.16.0-1~exp1",
      "6.17.0-1~exp1",
      "6.20.0-1~exp1",
      "6.21.0-1~exp1",
      "6.22.0-1~exp1",
      "6.23.0-1~exp1",
      "7.0.0-1~bpo13+1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41684.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "lxd",
      "purl": "pkg:deb/debian/lxd?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "5.0.2+git20231211.1364ae4-1",
      "5.0.2+git20231211.1364ae4-2",
      "5.0.2+git20231211.1364ae4-3",
      "5.0.2+git20231211.1364ae4-4",
      "5.0.2+git20231211.1364ae4-5",
      "5.0.2+git20231211.1364ae4-6",
      "5.0.2+git20231211.1364ae4-7",
      "5.0.2+git20231211.1364ae4-8",
      "5.0.2+git20231211.1364ae4-9",
      "5.0.2-5",
      "5.0.2-5+deb12u1",
      "5.0.2-5+deb12u2",
      "5.0.2-5+deb12u3",
      "5.0.2-5+deb12u4",
      "5.0.2-5+deb12u5",
      "5.0.2-5+deb12u6",
      "5.0.2-6"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41684.json"
    },
    "ecosystem_specific": {
      "urgency": "end-of-life"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "5.0.2+git20231211.1364ae4-9+deb13u6"
          }
        ]
      }
    ],
    "package": {
      "name": "lxd",
      "purl": "pkg:deb/debian/lxd?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "5.0.2+git20231211.1364ae4-9",
      "5.0.2+git20231211.1364ae4-9+deb13u1",
      "5.0.2+git20231211.1364ae4-9+deb13u2",
      "5.0.2+git20231211.1364ae4-9+deb13u3",
      "5.0.2+git20231211.1364ae4-9+deb13u4",
      "5.0.2+git20231211.1364ae4-9+deb13u5"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41684.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #57636 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 17:21:52 GMT
Publisher date: Thu, 07 May 2026 14:16:03 GMT

Read the original announcement