CVE-2026-62867: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-62867 is a critical argument injection vulnerability in Incus, an open-source system container and virtual machine manager, caused by improper validation of the block.create_options storage volume configuration key. A project-scoped user (not a server administrator) can inject arbitrary arguments into the filesystem creation binary executed as root, enabling privilege escalation, arbitrary file reads, or potential remote code execution. The vulnerability affects all Incus versions prior to v7.3.0 and is fixed in v7.3.0 (upstream) and Debian package version 6.0.4-2+deb13u9. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory).

The root cause is CWE-88 (Improper Neutralization of Argument Delimiters in a Command — Argument Injection). The block.create_options volume configuration key is validated using validate.IsAny, meaning no validation is applied whatsoever across all storage drivers that support it (LVM, Ceph, etc.). When a storage volume is created or formatted, the value is retrieved via vol.ExpandedConfig("block.create_options"), split by whitespace using strings.Fields(), and appended directly to the command slice passed to subprocess.TryRunCommand() — which executes the filesystem creation binary (e.g., mkfs) as root. The permission required to exploit this is only auth.EntitlementCanCreateStorageVolumes, a project-level entitlement, not a server administrator role. A proof-of-concept is publicly documented in the advisory: incus storage volume create default exploit --type=block block.create_options="-p /etc/shadow" (GitHub Advisory, GitHub PR #3750).

A user with only project-level can_create_storage_volumes permission can inject arbitrary flags into a filesystem creation binary running as root, enabling them to read arbitrary files on the host (e.g., /etc/shadow via XFS proto files), potentially achieve arbitrary command execution depending on the filesystem utility in use, cause filesystem corruption leading to denial of service, and escalate privileges beyond their intended project scope. The scope change (from project-level user to root-level host access) makes this a container/VM escape-class vulnerability with high confidentiality, integrity, and availability impact (GitHub Advisory).

A public proof-of-concept is included in the official GitHub Security Advisory, making exploitation straightforward for any user with project-level storage volume creation permissions. The CVE status was listed as "Reserved" at time of Feedly ingestion (July 31, 2026), and no CISA KEV catalog listing or EPSS score data is currently available. The vulnerability was independently discovered and responsibly disclosed by Zhixi "Jace" Sun (@manus-use), and no in-the-wild exploitation has been publicly reported as of the advisory date (GitHub Advisory).

1. Reconnaissance: Identify an Incus deployment running a version prior to v7.3.0 where the attacker has been granted project-level access with can_create_storage_volumes entitlement (not requiring admin privileges).
2. Craft malicious volume config: Prepare a storage volume creation command that sets block.create_options to inject arbitrary arguments, e.g., block.create_options="-p /etc/shadow" for XFS proto file reading.
3. Create the malicious volume: Execute incus storage volume create <pool> <volume-name> --type=block block.create_options="-p /etc/shadow" as the project-scoped user.
4. Trigger filesystem creation: Attach the volume to an instance or otherwise trigger formatting; Incus calls makeFSType() which splits block.create_options via strings.Fields() and appends the injected arguments to the root-executed filesystem creation command.
5. Achieve objective: The injected arguments are passed to the filesystem binary (e.g., mkfs.xfs) running as root, allowing the attacker to read sensitive host files, corrupt filesystems, or potentially achieve arbitrary command execution depending on the utility's flag set (GitHub Advisory, GitHub PR #3750).

• Logs: Incus daemon logs (incusd) showing storage volume creation requests with unusual block.create_options values containing spaces, dashes, or filesystem utility flags (e.g., -p, --proto, --device).
• Process: Unexpected arguments passed to filesystem creation binaries (mkfs.xfs, mkfs.ext4, lvcreate, etc.) running as root — particularly flags referencing sensitive host paths like /etc/shadow, /etc/passwd, or /root/.
• File System: Unexpected access or modification timestamps on sensitive host files (e.g., /etc/shadow) coinciding with storage volume creation events.
• Network: API calls to the Incus storage volumes endpoint (POST /1.0/storage-pools/<pool>/volumes) from project-scoped (non-admin) users with block.create_options set to non-standard values (GitHub Advisory).

Upgrade Incus to v7.3.0 or later (upstream), which restricts block.create_options in restricted projects to the pool's configured default, preventing project-scoped users from setting this option. Debian users should upgrade to package version 6.0.4-2+deb13u9 or later. As a workaround prior to patching, restrict project-level permissions to remove can_create_storage_volumes from untrusted users, or audit existing project configurations for unexpected block.create_options values. The fix was merged on July 30, 2026 (GitHub PR #3750, GitHub Advisory).

The vulnerability was announced alongside a broader set of security fixes for Incus 7.3, with Stéphane Graber (lead maintainer) publishing the advisory and merging the fix on July 30, 2026. An AusCERT bulletin (ESB-2026.8926) was issued, and Graber published a blog post announcing Incus 7.2.2 with related security context. The fix was noted as addressing the same vulnerability class as a prior advisory (GHSA-v6mj-8pf4-hhw4) but in a different, previously unpatched code path (AusCERT, Stéphane Graber Blog).