Debian Patches

Status for incus/6.0.6-2

Patch Description Author Forwarded Bugs Origin Last update
001-skip-TestConvertNetworkConfig.patch lxc prior to version 4.0.12 had a logic bug in do_lxcapi_create() that returned success in error conditions. Since this is a very simple test, that didn’t actually matter, but now to properly pass would require the setting up of a user-specific lxc configuration and sub[u|g]id mappings, which is just too much effort for a small test.diff --git a/cmd/lxc-to-incus/main_migrate_test.go b/cmd/lxc-to-incus/main_migrate_test.go
index 6fbff5fce..d3783b998 100644		 Mathias Gibbens <gibmat@debian.org> not-needed
002-adjust-import-paths.patch Adjust import paths to reflect Debian packagingdiff --git a/cmd/incusd/daemon.go b/cmd/incusd/daemon.go
index b16ebaff9..42887b714 100644		 Mathias Gibbens <gibmat@debian.org> not-needed
003-Compile-against-go-criu-v7.patch Compile against go-criu v7 Reinhard Tartler <siretart@tauware.de> no 2024-08-08
004-include-incusos-network-structs.patch Incus now consumes the IncusOS network API and cli package. This causes a dependency loop, so extract the relevant structs needed by Incus.diff --git a/cmd/incus/admin_os.go b/cmd/incus/admin_os.go
index 36a6e73d2..4ad31af10 100644		 Mathias Gibbens <gibmat@debian.org> not-needed
005-revert-4e828ca.patch Temporarily revert commit that broke running `incus exec` for VMsdiff --git a/cmd/incus-agent/dev_incus.go b/cmd/incus-agent/dev_incus.go
index 9dbf0c175..bc64243b6 100644		 Mathias Gibbens <gibmat@debian.org> yes
006-cherry-pick-gobgpv4.patch Cherry-pick changes for building with gobgp v4diff --git a/internal/server/bgp/logging.go b/internal/server/bgp/logging.go
deleted file mode 100644
index 20972659c..000000000		 Mathias Gibbens <gibmat@debian.org> no https://github.com/lxc/incus/pull/3078
110-CVE-2026-33542.patch [PATCH 1/4] client: Make ImageFileRequest require a ReadWriteSeeker
This is a small Go API break which is needed to address a security issue
where we need the ability to re-hash the final image files.

This is part of a fix for CVE-2026-33542.		 Stéphane Graber <stgraber@stgraber.org> no 2026-03-23
111-CVE-2026-33743.patch incusd/storage/s3: Don't assume backup structure
Properly skip anything that doesn't have the expected path prefix for a
file within the bucket. Then use strings.TrimPrefix rather than a fixed
offset to clear the prefix.

This addresses CVE-2026-33743		 Stéphane Graber <stgraber@stgraber.org> no 2026-03-23
112-CVE-2026-33897.patch incusd/instance: Use restricted pongo2 parser
The chroot logic in pongo2 doesn't work and therefore allows all
templates to read and write to arbitrary paths on the host filesystem.

Given the logic seemingly never worked properly, no template out there
should be dependent on the file related functions being functional.

Transition to our standard RenderTemplate logic which specifically block
all file related functions. Introduces a new RenderTemplateFile to
handle cases where we want to directly write to a file (useful for
write quotas).

This addresses CVE-2026-33897		 Stéphane Graber <stgraber@stgraber.org> no 2026-03-24
113-CVE-2026-33711.patch incusd/instance_console: Prevent symlink attacks
This fixes an issue when running on systems without the protect_symlinks
kernel protection enabled (introduced in 2012).

On such systems, a user could pre-create symlinks to sensitive files on
the system and trick Incus into truncating them and altering their file
mode and ownership.

This addresses CVE-2026-33711		 Stéphane Graber <stgraber@stgraber.org> no 2026-03-23
114-CVE-2026-33945.patch incusd/instance/lxc: Confine credentials write to credentials directory

systemd credentials name could be abused to escape the credentials
folder and allow for arbitrary writes to the host filesystem allowing
for privilege escalation and denial of service attacks.

We now use Go's OpenRoot (openat2) to restrict all file interactions to
the "credentials" directory, avoiding such attacks.

This addresses CVE-2026-33945		 Stéphane Graber <stgraber@stgraber.org> no 2026-03-24

All known versions for source package 'incus'

Links