CVE-2026-115372

Name of the Vulnerable Software and Affected Versions Incus versions 7.3.0 through 7.4.x

Description A project restriction bypass exists that allows restricted project users to set block.create options during volume update, copy, and move operations. An attacker can apply this option to a custom volume and initiate a copy or move to a formatting pool, enabling the injection of arguments into the mkfs function executed with root privileges.

Recommendations Update Incus to version 7.5.0 or later.