Back Linuxsecurity

Fedora 42 Incus 6.23 Security Update Advisory 2026

Linuxsecurity •LinuxSecurity Advisories • April 20, 2026

Container hypervisor based on LXC Incus offers a REST API to remotely manage containers over the network, using an image based work-flow and with support for live migration. This package contains the Incus daemon. Update Information : Remove incus dependency from incus-agent. Update to 6.23

Container hypervisor based on LXC

Incus offers a REST API to remotely manage containers over the network,

using an image based work-flow and with support for live migration.

This package contains the Incus daemon.

Remove incus dependency from incus-agent. Update to 6.23

* Thu Apr 9 2026 Carl George - 6.23-3 - Remove incus dependency from incus-agent rhbz#2456888 * Mon Apr 6 2026 Reto Gantenbein - 6.23-2 - Fix static builds of vendored dependencies (RHBZ 2419661) * Mon Apr 6 2026 Reto Gantenbein - 6.23-1 - Update to 6.23 * Mon Mar 30 2026 Neal Gompa - 6.19.1-4 - Drop selinux subpackage in favor of container-selinux * Tue Feb 3 2026 Maxwell G - 6.19.1-3 - Rebuild for * Fri Jan 16 2026 Fedora Release Engineering - 6.19.1-2 - Rebuilt for

[ 1 ] Bug #2390870 - incus: go-viper's mapstructure May Leak Sensitive Information in Logs [fedora-42] [ 2 ] Bug #2398840 - CVE-2025-47910 incus: CrossOriginProtection bypass in net/http [fedora-42] [ 3 ] Bug #2412795 - CVE-2025-58183 incus: Unbounded allocation when parsing GNU sparse map [fedora-42] [ 4 ] Bug #2432454 - CVE-2026-23954 incus: container image templating arbitrary host file read and write [fedora-42] [ 5 ] Bug #2432456 - CVE-2026-23953 incus: container environment configuration newline injection [fedora-42] [ 6 ] Bug #2441165 - CVE-2025-69725 incus: Go-chi/chi: Open Redirect vulnerability allows redirection to malicious websites [fedora-42] h... Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-4481307278' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora Incus 6.23 Security Update Addresses Multiple Vulnerabilities On April 20, 2026, Fedora released a security update for Incus 6.23, a container hypervisor based on LXC. The update removes the incus dependency from incus-agent and addresses several vulnerabilities. Notable CVEs include CVE-2025-58183, which involves unbounded allocation when parsing GNU sparse maps, and CVE-2026-23954, which allows arbitrary host file read and write through container image templating. Other vulnerabilities include CVE-2025-69725, an open redirect issue, and CVE-2026-23953, which involves newline injection in container environment configuration. The update is crucial for users of Fedora 42 and 43, as it mitigates potential exploits that could affect container management and security. Users are advised to apply the update using the 'dnf' package manager. The advisory emphasizes the importance of keeping systems updated to prevent exploitation of these vulnerabilities. 2 sources 58

Extracted Entities

Fedora 42 Incus 6.23 Security Update Advisory 2026

The full story

Extracted Entities

CVEs (5)

CWE Weaknesses (5)

Vulnerabilities (1)