CVE-2025-52890: Incus creates nftables rules that partially bypass security options

June 26, 2025 (updated March 30, 2026)

When using an ACL on a device connected to a bridge, Incus generates nftables rules that partially bypass security options security.mac_filtering, security.ipv4_filtering and security.ipv6_filtering. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge.

References

github.com/advisories/GHSA-p7fw-vjjm-2rwp
github.com/lxc/incus
github.com/lxc/incus/commit/254dfd2483ab8de39b47c2258b7f1cf0759231c8
github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp
nvd.nist.gov/vuln/detail/CVE-2025-52890

Code Behaviors & Features

Detect and mitigate CVE-2025-52890 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →