CVE-2026-115377

Summary

The vulnerability allows authenticated attackers to write arbitrary files on the host by injecting symlinks (e.g., 'rootfs') into migration streams, enabling full host compromise via root-level file writes.

Exploitability

Exploitation requires low-privilege access (PR:L) and no user interaction, but is limited to systems where the attacker can control the source of a container or VM migration stream.

Blast radius

Successful exploitation grants full root access to the host, compromising confidentiality, integrity, and availability across the entire system.

Detection

Monitor rsync or btrfs receive logs for unexpected symlink creation in volume rootfs paths, especially symlinks pointing outside the expected container/VM filesystem hierarchy.

Prioritized remediation

Upgrade to Incus 6.0.7, 7.0.2 (for 6.1.x branch), or 7.5.0 (for 7.1.x branch) immediately; no fixed version is published for versions outside these ranges.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.