Debian Patches

Status for incus/7.0.2-3

Patch Description Author Forwarded Bugs Origin Last update
100-GHSA-5pgx-q9xx-j3qv.patch incusd/storage: Strip non-regular files from instance metadata

This addresses GHSA-5pgx-q9xx-j3qv (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-10-22
101-GHSA-jcw9-v2ff-8m79.patch incusd: Authorize effective project on resource creation
This addresses GHSA-jcw9-v2ff-8m79 (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-10-20
102a-cherry-pick-CheckTrustStateIssuer.patch incusd/util: Add CheckTrustStateIssuer Stéphane Graber <stgraber@stgraber.org> no 2026-10-13
001-skip-TestConvertNetworkConfig.patch lxc prior to version 4.0.12 had a logic bug in do_lxcapi_create() that returned success in error conditions. Since this is a very simple test, that didn’t actually matter, but now to properly pass would require the setting up of a user-specific lxc configuration and sub[u|g]id mappings, which is just too much effort for a small test.diff --git a/cmd/lxc-to-incus/main_migrate_test.go b/cmd/lxc-to-incus/main_migrate_test.go
index 6fbff5fce..d3783b998 100644		 Mathias Gibbens <gibmat@debian.org> not-needed
002-remove-godebug.patch Remove a godebug tag no longer needed with module-aware buildsdiff --git a/cmd/incus-agent/main.go b/cmd/incus-agent/main.go
index 4addc5d829..5a000d7bc5 100644		 Mathias Gibbens <gibmat@debian.org> not-needed
003-Compile-against-go-criu-v7.patch Compile against go-criu v7 Reinhard Tartler <siretart@tauware.de> no 2024-08-08
004-renameio-v2-gomod.patch Switch indirect dependency on google/renameio to v2, needed to align versions of that library for module-aware builds.diff --git a/go.mod b/go.mod
index 51afecb668..28d324f675 100644		 Mathias Gibbens <gibmat@debian.org> not-needed
102b-GHSA-xg75-xf37-cph9.patch incusd: Only trust the key-proven client certificate
The HTTPS listener uses tls.RequestClientCert, so the TLS handshake only
proves possession of the first certificate in the client's chain. The
authentication and certificate ownership checks looped over the whole
chain and matched each certificate against the trust store, letting a
client authenticate as, or take over, any trust entry by appending that
entry's public certificate to its own chain.

Match only the first peer certificate in every trust-store check.

This addresses GHSA-xg75-xf37-cph9 (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-10-13
103-GHSA-p45f-gqqj-6qq3.patch incusd/storage: Validate snapshot names from the backup index on import

The snapshot names listed at the top of the backup index are validated
on import, but the database records are created from the names in the
volume config section of the same index, which weren't. A crafted
backup could therefore store a snapshot name containing path traversal
which is later resolved by the storage driver, for example when the
volume is deleted.

Validate those names too and require them to match the top level list.

This addresses GHSA-p45f-gqqj-6qq3 (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-10-06
104-GHSA-q9fc-p923-6vp7.patch incusd/storage: Validate dependent volumes received through migration

The names of dependent volumes received through migration were used as
path segments without validation, letting a malicious source create
volumes outside of the storage pool.

The index header sent by the source was also indexed by the position of
the volume in the offer header, with no check that the lists match, and
optional protobuf fields were dereferenced unconditionally, letting a
malicious source crash the daemon.

Validate the names as is done for backups, check the index header
before using it and use the nil-safe protobuf getters.

This addresses GHSA-q9fc-p923-6vp7 (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-10-03
105-GHSA-cwg9-8mc4-hf7j.patch incusd/operations: Protect token operations from events and cancellation

Token operations are only readable by clients allowed to create the
matching token, but their events, including the secret, were sent to
any client able to view events in the default project. Such a client
could then reconstruct a certificate token and enroll an unrestricted
certificate.

Cancelling an operation also skipped all checks when the operation type
has no associated permission, which includes token operations, so any
authenticated client could cancel them by UUID.

Keep the metadata of token operations out of the event stream and
check access before cancelling an operation. Operations without a
specific permission can be cancelled by their requestor or by clients
able to edit the project.

This addresses GHSA-cwg9-8mc4-hf7j (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-09-30
106-GHSA-5c64-j5m6-8433.patch incusd: Check resource creation against the effective project
Creation entitlements were checked against the requested project while
the resource was created in the project it is inherited from. A client
restricted to a project with a feature disabled could therefore create
networks, network ACLs, address sets, zones, profiles, custom volumes,
buckets, images and aliases in the default project.

Resolve the effective project for creation entitlements the same way as
for existing objects.

This addresses GHSA-5c64-j5m6-8433 (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-09-27
107-GHSA-3wxw-5gh2-j2x2.patch [PATCH 1/3] incusd/instance/lxc: Reject line breaks in LXC config values

Values from an OCI image's config.json and from the oci.entrypoint and
oci.cwd keys were written into the LXC config without validation. As
that file is line based, a line break lets an image or instance config
inject arbitrary directives, such as a hook running as root on the host.

Refuse line breaks in the config setter, in the OCI environment parser
and in the oci.* keys.

This addresses GHSA-3wxw-5gh2-j2x2 (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-09-25
108a-cherry-pick-helpers.patch Cherry-pick two helper functions from upstream commit b17e9f4936cb1a1ea08787476c07ccb988999b1fdiff --git a/internal/server/instance/drivers/driver_qemu.go b/internal/server/instance/drivers/driver_qemu.go
index 4370f474ca..d3e9dd8b15 100644		 Mathias Gibbens <gibmat@debian.org> not-needed
108b-GHSA-3rgf-297m-775x.patch incusd/instance/qemu: Confine NBD migration sockets to the run directory

The NBD migration and export sockets used abstract unix sockets with no
access control, so any local user in the host network namespace could
connect to them. Bind path sockets in the root only run directory and
pass the descriptors to QEMU, and check the peer PID on the source
listener.

This addresses GHSA-3rgf-297m-775x (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-10-23
109-GHSA-9c46-v3hw-v6m8.patch incusd/instance/lxc: Allocate an idmap when none is set at start

A rebuild of a never-started unprivileged container deletes
volatile.idmap.next and volatile.last_state.idmap, and
volatile.idmap.current is only written on start, so all three are absent.
The start-time check only reallocated a map when one already existed, so
the container booted with an identity map, running as privileged.

Allocate a map whenever an unprivileged instance has none.

This addresses GHSA-9c46-v3hw-v6m8 (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-10-17
110-GHSA-h2j8-4crh-vhfc.patch incusd/operations: Keep websocket secrets out of events and queries

Migration operations embed their per-connection websocket secrets in the
operation metadata, which was broadcast to every event listener and
returned by operation queries. Unlike exec and console, the migration
websocket authorizes on the secret alone, so a project event viewer could
read the secret and hijack an in-flight migration's data channels.

Return the connection secrets only in the synchronous create response and
strip them from every other render.

This addresses GHSA-h2j8-4crh-vhfc (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-10-16
111-GHSA-8r3h-vc36-6xpx.patch incusd/auth/tls: Restrict inherited reads to the certificate's projects

Restricted certificates get read-only access to resources in the
default project so that projects without a feature enabled can use the
inherited resources. That access was granted regardless of the project
being accessed, so a restricted client could read profiles, images,
volumes, buckets, networks, zones and their backups in the default
project by requesting it directly.

Only allow inherited reads when the request is made through a project
the certificate is trusted for. Additionally hide network zone peer
keys from clients who can't edit the zone, as is done for networks.

This addresses GHSA-8r3h-vc36-6xpx (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-09-30
112-GHSA-v736-5xp3-jghf.patch incusd/dev_incus: Anchor the cgroup based monitor detection
The cgroup fallback accepted the first lxc.monitor. found anywhere in
the path, so a container could create a cgroup named after another
container below its own and be identified as it. Only trust the first
lxc.payload. or lxc.monitor. component, which a container can't forge.

This addresses GHSA-v736-5xp3-jghf (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-09-25
113-GHSA-x6pw-mh5w-pq73.patch incusd: Reject null snapshot entries on backup import
This addresses GHSA-x6pw-mh5w-pq73 (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-10-26
114-GHSA-pf5w-m8m6-5265.patch incusd: Fix cross-project disclosure in recursive and all-projects listings

This addresses GHSA-pf5w-m8m6-5265 (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-10-20
115-GHSA-f7xp-22ph-v444.patch incusd/dev_incus: Pin image export to the instance's project
The guest-API image export passed the guest-controllable project query
parameter straight through to imageExport, letting a container with
security.guestapi.images export any public or cached image of any
project. Force the instance's own project.

This addresses GHSA-f7xp-22ph-v444 (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-10-16
116-GHSA-9f75-5fjw-5jvv.patch incusd/events: Restrict network-acl events to privileged viewers

OVN ACL log events are broadcast with an empty project, so the per-project
binding and permission checks in the event server are skipped and any
client with view-events on a single project received every project's ACL
logs. The project can't be recovered from the raw OVN syslog text, so treat
network-acl as a privileged event type like logging.

This addresses GHSA-9f75-5fjw-5jvv (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-10-16
117-GHSA-8mgx-h4v8-xqv2.patch incusd/storage/s3: Verify signed payloads without buffering
Requests with a signed payload had their whole body read into memory to
verify its hash before the signature was checked and before the
credential role was enforced. Anyone knowing a valid access key could
have the daemon buffer arbitrarily large bodies.

Verify the signature first, using the hash claimed in the request, then
verify the body against that hash as it's consumed. This also stops
buffering objects uploaded by valid credentials. The multipart
completion body is additionally bounded.

This addresses GHSA-8mgx-h4v8-xqv2 (CVE pending)		 Stéphane Graber <stgraber@stgraber.org> no 2026-09-30

All known versions for source package 'incus'

Links