CVE-2025-52890

Name of the Vulnerable Software and Affected Versions: Incus versions 6.12 and 6.13

Description: Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, it generates nftables rules that partially bypass security options security.mac filtering, security.ipv4 filtering, and security.ipv6 filtering. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge.

Recommendations: For Incus versions 6.12 and 6.13, apply the patch from commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 to resolve the issue.