CVE-2026-115377 lxc CVE debrief

Who should care

System administrators and security teams responsible for Incus container management, especially those with untrusted or externally sourced migration streams, should be aware of this vulnerability. They need to assess their exposure, update to a secure version if necessary, and implement additional monitoring for suspicious migration activities. This includes reviewing and updating container management policies to address potential symlink attacks and to .

Why it matters

CVE-2026-115377 is a critical vulnerability in Incus that allows for arbitrary file writes via symlinks in migration streams. It requires immediate attention from system administrators and security teams to update affected versions and restrict migration sources to prevent potential full host compromise and data integrity risks.

• Potential for full host compromise if exploited.
• Elevation of privileges to root access.
• Data integrity and confidentiality risks due to arbitrary file writes.
• Need for immediate version updates and migration stream validation.

Technical summary

The vulnerability allows malicious migration sources to write host files by creating symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink, such as 'rootfs' pointing to the host root, allowing them to write files as root. This could lead to full host compromise if exploited. The vulnerability affects Incus versions before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0. System administrators and security teams should immediately assess and update to a secure version if using affected versions.

Defensive priority

High priority for systems using Incus for container management, especially those with untrusted or externally sourced migration streams.

Recommended defensive actions

• Immediately assess and update Incus to a secure version (6.0.7, 7.0.2, or 7.5.0) if using affected versions.
• Restrict migration sources to trusted and validated inputs.
• Implement additional monitoring for suspicious migration activities.
• Review and update container management policies to address potential symlink attacks.
• Perform vulnerability scanning to identify exposed systems.
• Establish a remediation timeline based on risk assessment.
• Document lessons learned for future vulnerability management.

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and potential attack vectors. However, there is limited information on actual exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.