This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-63125 →

UBUNTU-CVE-2026-63125

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC id...

Original description

The description as published by the source.

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with can_create_images and can_create_instances) can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to a host file. When the root daemon writes the instance's backup file, it follows the symlink. Version 7.3.0 patches the issue.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:Pro:24.04:LTS incus

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.10 incus

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:26.04:LTS incus

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

report ubuntu.com
report cve.org
report github.com
report github.com