CVE-2026-23954: 
NixOS vulnerability analysis and mitigation

CVE-2026-23954 is a path traversal and symbolic link vulnerability in Incus, a system container and virtual machine manager developed by the Linux Containers community. It affects Incus versions 6.0.5 and below, as well as versions 6.1.0 through 6.20.0, and is also exploitable in IncusOS environments. The vulnerability was disclosed on January 22, 2026, via a GitHub Security Advisory published by the Incus maintainer. It carries a CVSS v3.1 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), located in internal/server/instance/drivers/driver_lxc.go at lines 7215 and 7294. When Incus processes a container image's metadata.yaml file containing template definitions, neither the source nor the target paths are validated for directory traversal sequences (e.g., ../../../../) or symbolic links. An attacker can craft a malicious image with a metadata.yaml that uses traversal sequences in the template source path to read arbitrary host files (e.g., /etc/shadow), and place a symbolic link in the container rootfs pointing to / to cause template content to be written to arbitrary host filesystem locations as root. Exploitation requires only that the attacker be a member of the incus group (or otherwise have permission to launch containers with custom images) — no additional privileges or user interaction are needed (GitHub Advisory).

Successful exploitation grants an attacker arbitrary file read and arbitrary file write on the host filesystem as root, which directly enables arbitrary command execution on the host — constituting a full container escape and complete system compromise. A demonstrated attack vector involves overwriting /proc/sys/kernel/core_pattern with a malicious payload, then triggering a crash inside the container to execute commands on the host as root. Sensitive data such as /etc/shadow can be exfiltrated, and critical system files can be modified, enabling persistent access or lateral movement across the host (GitHub Advisory, Feedly).

A public proof-of-concept exploit script (template_arbitrary_write.sh) is available and demonstrates both arbitrary file read and container escape leading to host command execution (PoC Script). A patch file is also publicly available. As of the time of publication, there is no evidence of in-the-wild exploitation. The EPSS score is approximately 0.09% (0.0009), indicating low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Prepare a malicious container image: Obtain a legitimate Linux root filesystem (e.g., Alpine Edge). Unpack it into a directory named rootfs.
2. Create a symbolic link for host write: Inside the rootfs, create a symbolic link named realroot pointing to the host root: ln -s / rootfs/realroot.
3. Craft the malicious metadata.yaml: Define two templates — one using directory traversal to read a host file (e.g., template: ../../../../../../../../etc/shadow targeting /shadow inside the container), and one targeting /realroot/proc/sys/kernel/core_pattern to write a malicious core pattern template.
4. Prepare the core pattern payload: Create a templates/core_pattern.tpl file containing |/bin/sh -c "%E" to execute arbitrary commands via core dumps.
5. Add exploit binaries to rootfs: Place a segfault.c (trivial null-pointer dereference) and a stage2 shell script (e.g., id > /template_arbitrary_write_cmd_exec_poc) in the rootfs; make stage2 executable.
6. Package and import the image: Archive the directory (tar cf poc.tar *) and import it into Incus (incus image import poc.tar --alias poc).
7. Launch the container: Run incus launch poc poc --ephemeral. On start, Incus processes the templates, reading /etc/shadow from the host into the container and writing the malicious core_pattern to the host via the realroot symlink.
8. Trigger code execution: Inside the container, compile segfault.c with a filename that encodes the path to stage2, then execute the binary to trigger a segfault. The host kernel executes the core_pattern handler, which finds and runs stage2 on the host as root, writing proof of execution to the host filesystem (GitHub Advisory, PoC Script).

• File System: Unexpected files in the host root filesystem (e.g., /template_arbitrary_write_cmd_exec_poc); modified /proc/sys/kernel/core_pattern containing shell command strings (e.g., |/bin/sh -c "%E"); presence of symbolic links named realroot pointing to / inside container rootfs directories under /var/lib/incus/containers/*/rootfs/.
• Incus Image Store: Presence of recently imported custom images with unusual metadata (e.g., os: Exploit, description: Exploit) in the Incus image store (incus image list).
• Logs: Incus daemon logs showing container launches with custom images followed by unexpected file creation events on the host; core dump events triggered from within containers.
• Process: Unexpected processes spawned by the Incus daemon or kernel core dump handler (e.g., /bin/sh, shell scripts executing from container rootfs paths); unusual child processes of incusd writing to host filesystem locations outside container boundaries (GitHub Advisory, PoC Script).

Upgrade Incus to version 6.0.6 (for the 6.0.x LTS branch) or version 6.21.0 (for the 6.1.x and later branches), which contain fixes for this vulnerability. Until patching is complete, restrict membership in the incus group to only fully trusted users, and limit which users can launch containers with custom images. Additionally, implement host-level access controls to restrict file access by container processes, and audit all custom container images currently in use for suspicious metadata.yaml template definitions. A patch file is publicly available for manual application if needed (GitHub Advisory, Patch File).

The vulnerability was discovered and reported by rmcnamara-snyk (a Snyk security researcher) and remediated by Incus maintainer stgraber. Snyk Labs published a technical write-up covering this and related Incus vulnerabilities involving newline injection, symlinks, and arbitrary writes (Snyk Labs). The Incus 6.21.0 release announcement by stgraber addressed this security fix (stgraber.org). Coverage was also noted on Linux security news aggregators and community platforms including linuxsecurity.com and linuxiac.com following the patch release.