CVE-2026-41684: 
NixOS vulnerability analysis and mitigation

CVE-2026-41684 is a NULL pointer dereference vulnerability ("Nil Dereferences on Restore via Malformed YAML") in Incus, a system container and virtual machine manager maintained by Linux Containers. It affects all Incus versions prior to 7.0.0 and was published on April 30, 2026, with a patch released on May 1, 2026. An authenticated user with backup import permissions can crash the Incus daemon by submitting a specially crafted backup archive. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is a NULL pointer dereference (CWE-476) in Incus's backup restore logic. backup.GetInfo() trusts the inline backup/index.yaml when present and only falls back to parsing the legacy backup/container/backup.yaml if result.Config == nil. An attacker can craft an archive with a valid backup/index.yaml (satisfying the preflight check) alongside a malformed backup/container/backup.yaml that omits the container section. After archive extraction, backup.UpdateInstanceConfig() and internalImportFromBackup() reparse the extracted legacy YAML via ParseConfigYamlFile(), which accepts documents with no container section without validation, resulting in backup.Container == nil. Subsequent unconditional dereferences of backup.Container.Devices and backup.Container.ExpandedDevices trigger a nil-pointer dereference panic, crashing the daemon. Affected code paths are documented in backup_info.go, backup_config_utils.go, backend.go, and api_internal.go (GitHub Advisory).

Successful exploitation causes a denial of service by crashing the Incus daemon process, making all managed containers and virtual machines unavailable until the daemon is restarted. The crash occurs after archive extraction has begun, meaning partial state changes may have already been applied to the instance volume. There is no confidentiality or integrity impact — the vulnerability is limited to availability (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been confirmed. The GitHub Security Advisory includes a proof-of-concept Go test (TestExtractedBackupYAMLMissingContainerNilDereference) that demonstrates the panic, but this is a unit test rather than a weaponized exploit. Exploitation requires authentication and the backup import permission, limiting the attack surface. The EPSS score is 0.063% (low probability of exploitation). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Obtain credentials: Acquire an authenticated Incus account with permission to import instance backups (e.g., a low-privileged user granted backup import rights).
2. Craft the malicious archive: Create a backup archive (.tar.gz) containing:
   • A valid backup/index.yaml with a complete, well-formed inline configuration (including a container section) to pass the preflight check.
   • A malformed backup/container/backup.yaml that omits the container section entirely (e.g., contains only pool: or volume: keys, or is an empty YAML document).
3. Submit the archive: Use the Incus CLI or API to import the crafted backup: incus import <crafted-archive.tar.gz>.
4. Trigger the crash: The Incus daemon processes the archive — backup.GetInfo() reads the valid backup/index.yaml and populates bInfo.Config, passing preflight. Storage unpacking extracts the malformed backup/container/backup.yaml into the instance volume. backup.UpdateInstanceConfig() reparses the extracted file, finds backup.Container == nil, and dereferences it unconditionally, causing a nil-pointer dereference panic that crashes the incusd daemon (GitHub Advisory).

• Logs: Incus daemon logs (journalctl -u incus) showing a Go runtime panic: runtime error: invalid memory address or nil pointer dereference originating from backup.UpdateInstanceConfig() or internalImportFromBackup().
• Logs: Log entries indicating a backup import operation was initiated shortly before the daemon crash, particularly from an unexpected or low-privileged user account.
• Process: Unexpected termination and restart of the incusd process.
• File System: Presence of a partially extracted backup volume in the Incus storage pool directory, indicating the archive extraction began but did not complete cleanly.
• File System: A backup.yaml file within an instance volume directory that lacks a container: section, which is structurally invalid for a legitimate Incus backup.

Upgrade Incus to version 7.0.0 or later, which includes the fix adding nil checks before any dereference of backup.Container in backup.UpdateInstanceConfig() and internalImportFromBackup() (Incus v7.0.0 Release). As a workaround prior to patching, restrict backup import permissions to fully trusted administrative users only, reducing the attack surface. Additionally, validate and inspect backup archives before import to ensure both backup/index.yaml and backup/container/backup.yaml contain a valid container section (GitHub Advisory).

The vulnerability was discovered and reported by the team at 7asecurity (raefko and Ectario), and the fix was developed by Incus maintainer Stéphane Graber (stgraber). The advisory was published at a "Moderate" severity level, reflecting the authentication requirement that limits exploitability. Coverage was picked up by Linux security advisory aggregators and vulnerability databases shortly after disclosure (GitHub Advisory).