CVE-2025-52890: Incus vulnerable to antispoofing nftables firewall rule bypass on bridge networks with ACLs

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-25 · updated 2026-06-17
Weakness: CWE-863

Description

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue.

Affected products

lxc incus: from 6.12, <= 6.13

References

https://github.com/lxc/incus/commit/254dfd2483ab8de39b47c2258b7f1cf0759231c8
https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp
https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp

Get alerted when CVE-2025-52890 or the next vulnerability affects your stack