Description

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.

INFO

Published Date :

2025-06-25T16:49:00.442Z

Last Modified :

2025-06-25T17:54:29.213Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-52889 vulnerability.

No data.

REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-52889.

URL Resource
https://github.com/lxc/incus/commit/2516fb19ad8428454cb4edfe70c0a5f0dc1da214 cve-icon cve-icon
https://github.com/lxc/incus/commit/a7c33301738aede3c035063e973b1d885d9bac7c cve-icon cve-icon
https://github.com/lxc/incus/security/advisories/GHSA-9q7c-qmhm-jv86 cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact