Bug 2374783 (CVE-2025-52889) - CVE-2025-52889 incus: Incus denial of service
Summary: CVE-2025-52889 incus: Incus denial of service
Keywords:
Status: NEW
Alias: CVE-2025-52889
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2374808 2374809
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-06-25 17:01 UTC by OSIDB Bzimport
Modified: 2025-06-26 22:25 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-06-25 17:01:10 UTC 
Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.
Note You need to log in before you can comment on or make changes to this bug.