Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user. The most common case for this would be systems using `incus-user` with the less privileged `incus` group to provide unprivileged users with an isolated restricted access to Incus. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unprivileged user on the host to gain root privileges. A patch for this issue is expected in versions 6.0.6 and 6.19.0. As a workaround, permissions can be manually restricted until a patched version of Incus is deployed.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-6057 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6057-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     November 13, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : lxd     CVE ID         : CVE-2025-64507

    It was discovered that LXD, a system container and virtual machine     manager, is prone to a local privilege escalation vulnerability if     unprivileged users are allowed to access LXD through lxd-user.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 5.0.2-5+deb12u2.

    We recommend that you upgrade your lxd packages.

    For the detailed security status of lxd please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/lxd

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6051 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6051-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     November 10, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : incus     CVE ID         : CVE-2025-64507

    It was discovered that Incus, a system container and virtual machine     manager, is prone to a local privilege escalation vulnerability     unprivileged users are allowed access to Incus through incus-user.

    For the stable distribution (trixie), this problem has been fixed in     version 6.0.4-2+deb13u2.

    We recommend that you upgrade your incus packages.

    For the detailed security status of incus please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/incus

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0     affects any Incus user in an environment where an unprivileged user may have root access to a container     with an attached custom storage volume that has the `security.shifted` property set to `true` as well as     access to the host as an unprivileged user. The most common case for this would be systems using `incus-     user` with the less privileged `incus` group to provide unprivileged users with an isolated restricted     access to Incus. Such users may be able to create a custom storage volume with the necessary property     (depending on kernel and filesystem support) and can then write a setuid binary from within the container     which can be executed as an unprivileged user on the host to gain root privileges. A patch for this issue     is expected in versions 6.0.6 and 6.19.0. As a workaround, permissions can be manually restricted until a     patched version of Incus is deployed. (CVE-2025-64507)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
275377	Debian dsa-6057 : lxd - security update	Nessus	Debian Local Security Checks	high
274638	Debian dsa-6051 : golang-github-lxc-incus-dev - security update	Nessus	Debian Local Security Checks	high
274626	Linux Distros Unpatched Vulnerability : CVE-2025-64507	Nessus	Misc.	high

Detections

Analytics

CVE-2025-64507

high

Tenable Plugins

high

high

high