← Vulnerability feed

Vulnerability record · CVE-2025-64507 · published 10 November 2025

CVE-2025-64507: Linuxcontainers incus improper privilege management vulnerability

Linuxcontainers · Incus

Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user. The most common case for this would be systems using `incus-user` with the less privileged `incus` group to provide unprivileged users with an isolated restricted access to Incus. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unprivileged user on the host to gain root privileges. A patch for this issue is expected in versions 6.0.6 and 6.19.0. As a workaround, permissions can be manually restricted until a patched version of Incus is deployed.

8.6 CVSS 4.0 High EPSS 0.17% · top 94.6% CWE-269 · Improper privilege management
8.6CVSS 4.0 base score
0.17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user. The most common case for this would be systems using `incus-user` with the less privileged `incus` group to provide unprivileged users with an isolated restricted access to Incus. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unprivileged user on the host to gain root privileges. A patch for this issue is expected in versions 6.0.6 and 6.19.0. As a workaround, permissions can be manually restricted until a patched version of Incus is deployed.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/lxc/incus/issues/2641 ExploitIssue TrackingPatch
https://github.com/lxc/incus/pull/2642 ExploitIssue TrackingPatch
https://github.com/lxc/incus/security/advisories/GHSA-56mx-8g9f-5crf ExploitPatchVendor Advisory
https://github.com/lxc/incus/issues/2641 ExploitIssue TrackingPatch

Track CVE-2025-64507 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2026-33897Linuxcontainers incus vulnerabilityIncus is a system container and virtual machine manager. Prior to version 6.23.0, instance template files can be used to cause arbitrary read or writ…EPSS 0.53%9.6CVE-2026-33945Linuxcontainers incus path traversal vulnerabilityIncus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For container…EPSS 0.53%8.8CVE-2026-33898Linuxcontainers incus improper authentication vulnerabilityIncus is a system container and virtual machine manager. Prior to version 6.23.0, the web server spawned by `incus webui` incorrectly validates the a…EPSS 0.48%8.7CVE-2026-23953Linuxcontainers incus vulnerabilityIncus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YA…EPSS 0.50%8.7CVE-2026-23954Linuxcontainers incus path traversal vulnerabilityIncus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with a custom …EPSS 0.79%7.1CVE-2026-40251Linuxcontainers incus vulnerabilityIncus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows…EPSS 0.47%7.1CVE-2026-40195Linuxcontainers incus null pointer dereference vulnerabilityIncus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows…EPSS 0.44%7.1CVE-2026-40197Linuxcontainers incus null pointer dereference vulnerabilityIncus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows…EPSS 0.44%

Source: NIST National Vulnerability Database (record CVE-2025-64507), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.