EUVD-2026-309001

fkie_cve-2026-41647

Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0.

GHSA-fwj8-62r8-8p8m — Incus has Nil-Pointer Dereference via S3 Bucket Import

Affected: Go: github.com/lxc/incus/v6/cmd/incusd

### Summary Missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file.

### Details It was found that TransferManager.UploadAllFiles iterates over tar entries but only checks for io.EOF from tr.Next(). When tr.Next() returns a non-EOF error, such as unexpected EOF from a truncated archive, the header hdr is nil and the code continues to access hdr.Name, causing a nil-pointer dereference that panics the daemon.

This may allow the Incus daemon to be crashed during S3 bucket restore if a truncated or corrupted backup archive is provided. A panic can occur when a malformed archive produces a non-EOF tar read error after the first entry. Any caller of UploadAllFiles that processes attacker-controlled archive content may be affected.

Affected File: [https://github.com/lxc/incus/blob/v6.22.0/…server/storage/s3/transfer_manager.go#L127](https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/s3/transfer_manager.go#L127)

The tar-iteration loop only checks for EOF:

Affected Code: ``` for { hdr, err := tr.Next() if err == io.EOF { break // End of archive. }

// Skip index.yaml file if hdr.Name == "backup/index.yaml" { ```

When tr.Next() returns a non-EOF error, hdr is nil. The code does not check for this case and immediately dereferences hdr.Name.

This was confirmed as follows:

Command: ``` go test ./test/fuzz -run='FuzzS3BucketUploadTarParsing/s3_nil_…

UBUNTU-CVE-2026-41647

Affected: Ubuntu:Pro:24.04:LTS: incus, Ubuntu:25.10: incus, Ubuntu:Pro:26.04:LTS: incus

Most recent entries from all

bdu:2026-09698

EUVD-2026-309001

fkie_cve-2026-41647

GHSA-fwj8-62r8-8p8m — Incus has Nil-Pointer Dereference via S3 Bucket Import

UBUNTU-CVE-2026-41647