Linux EUVD-2026-16462

Incus (cpe:2.3:a:lxc:incus) is a system container and virtual machine manager providing an API for VM screenshot retrieval. The screenshot functionality relies on creating temporary files in /tmp with predictable paths, which QEMU uses to write screenshot data before the Incus service retrieves and transmits the file to the user. This design pattern is vulnerable to symlink-based attacks exploiting CWE-61 (Insecure Temporary File), a weakness where predictable temporary file locations allow attackers to pre-create symlinks to arbitrary targets. Most modern Linux kernels implement the protected_symlinks feature (sysctl kernel.protected_symlinks=1) which blocks such attacks by preventing unprivileged processes from following symlinks in sticky directories like /tmp that are owned by other users. However, on systems where this security feature has been explicitly disabled or unavailable, an attacker with local authentication can create malicious symlinks ahead of time, causing Incus to truncate, alter permissions, or modify arbitrary files when writing screenshots, leading to file system integrity compromise.