CVE-2026-115377 is a critical symlink-handling flaw in Incus. A malicious migration source can use it to write files anywhere on the destination host as root, which leads to full host compromise.
What Is It
CVE-2026-115377 is an arbitrary file write vulnerability in Incus, the LXC project's container and virtual machine manager. It is classified as CWE-59 (Improper Link Resolution Before File Access).
The flaw is in how Incus handles volumes received during migration. A malicious migration source can plant symlinks inside the transferred volumes. According to the NVD description, an attacker can craft rsync or btrfs receive streams that contain a symlink, such as rootfs, pointing to the host root. When the receiving host processes the stream, it writes files through that symlink as root.
VulnCheck disclosed the issue and NVD published it on 2026-10-22. The NVD record currently has the status "Received."
Why It Matters
VulnCheck scores the flaw 9.9 (Critical) under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and 9.4 (Critical) under CVSS 4.0. The vector shows that the flaw:
- can be exploited over the network with low attack complexity
- needs only low privileges and no user interaction
- has a changed scope, meaning the impact reaches past the vulnerable component to the underlying host
Root-level file writes on the host give the attacker full host compromise. Every container and VM running on that host is exposed as a result.
Exploitation status: CVE-2026-115377 has no entry in CISA's Known Exploited Vulnerabilities (KEV) catalog, so active exploitation in the wild is not confirmed. The CVSS 4.0 Exploit Maturity metric is "Not Defined."
What's Vulnerable
The affected component is incusd (pkg:golang/github.com/lxc/incus/v7/cmd/incusd). Vulnerable version ranges:
| Branch | Affected | Fixed |
|---|---|---|
| 6.0.x and earlier | < 6.0.7 | 6.0.7 |
| 6.1.0 – 7.0.x | 6.1.0 to < 7.0.2 | 7.0.2 |
| 7.1.0 – 7.4.x | 7.1.0 to < 7.5.0 | 7.5.0 |
The risk is highest on hosts that accept migrations, where an untrusted or compromised system could act as the migration source.
Patch Status
Fixed releases are available. Upgrade Incus to one of these versions:
- 6.0.7 for the 6.0 LTS branch
- 7.0.2 for the 7.0 branch
- 7.5.0 for the current feature branch
Because this is not a KEV entry, CISA has not set a federal remediation deadline. A 9.9 CVSS score with a host-takeover impact still justifies patching right away, starting with hosts that receive migrations. Check the GitHub security advisory for further vendor guidance.