Incus 7.3 has been released - News - Linux Containers Forum

= 40rem)" rel="stylesheet" data-target="chat_desktop" /><br>= 40rem)" rel="stylesheet" data-target="discourse-reactions_desktop" /><br>= 40rem)" rel="stylesheet" data-target="poll_desktop" />

Incus 7.3 has been released

News

release,<br>incus

stgraber

(Stéphane Graber)

July 31, 2026, 6:08pm

The Incus team is pleased to announce the release of Incus 7.3!

Another busy release for us, both on the feature front with quite a lot of exciting new features as well as on the performance, bugfix and securty front.

As usual, you can try Incus for yourself online: Linux Containers - Incus - Try it online

Security fixes

This release fixes 13 security issues:

CVE-2026-62867 (critical) - Argument injection through storage volume block.create_options

CVE-2026-62940 (critical) - Project restriction bypass via instance migration config override

CVE-2026-62941 (critical) - Project restriction bypass via cross-project instance copy

CVE-2026-63125 (critical) - Arbitrary file write on host via backup.yaml symlink in crafted image

CVE-2026-63343 (critical) - Arbitrary file read+write on host via metadata.yaml symlink in crafted image

GHSA-26gp-p5fw-3r2h (critical) - Arbitrary file write on host via path traversal in instance backup import

GHSA-67qw-68v3-36h6 (critical) - Arbitrary file write on host via path traversal in custom volume import

GHSA-7fj9-65v4-rp7h (critical) - Arbitrary file write on host via image-planted symlinks and oci.dns.* newline injection

GHSA-p2v3-6wvc-cv3p (critical) - Arbitrary file write on host via image fingerprint path traversal

GHSA-4qxq-p5hm-3q3p (high) - Arbitrary file read+write on host via VM template path traversal

GHSA-m3j6-p3v3-qmjv (high) - Container configuration newline injection through nvidia.driver.capabilities

CVE-2026-62313 (medium) - Project isolation restriction bypass by omitting security.idmap.isolated

GHSA-6v6x-387m-rj4w (medium) - Project restriction bypass on network address sets

Note that some of the above don’t yet have CVE assigned. This is due to Github having a 3-4 weeks backlog on CVE assignments right now. We have requested CVEs for all the issues above and they will be automatically added to the relevant GHSA once allocated.

New features

GPU sharing for virtual machines through DRM native context

A new native-context GPU type is now available for virtual machines.

This makes use of virglrenderer and the virtio-gpu type to provide GPU 3D acceleration.

Unlike full GPU passthrough, this can be used by multiple virtual machines in parallel.

Currently, only Linux appears to have drivers fully supporting this, so Windows guests remain unaccelerated.

This can be enabled with:

stgraber@vorash:~$ incus config device add v1 gpu0 gpu gputype=native-context

Documentation: Type: gpu - Incus documentation

UEFI variable management for virtual machines

Incus now allows direct NVRAM interactions for virtual machines.

This is exposed through the CLI as incus low-level nvram and allows for both read and write access to the NVRAM.

Most UEFI NVRAM configuration keys can be parsed and updated, allowing for modification of the boot devices, boot order and more. Write operation require a stopped VM. A follow-up will focus specifically on UEFI Secure Boot key provisioning.

Additionally, a new rebuild-nvram repair action was added to incus low-level repair, making it easy to reset a virtual machine’s UEFI NVRAM to a clean state.

stgraber@vorash:~$ incus launch images:debian/13 v1 --vm<br>Launching v1<br>stgraber@vorash:~$ incus low-level nvram get v1 Boot0000<br>binary: CQEAACwAQgBvAG8AdABNAGEAbgBhAGcAZQByAE0AZQBuAHUAQQBwAHAAAAAEBxQAyb24fOv4NE+q6j7kr2UWoQQGFADcW8Lu8meVTbHV+BsgOdEdf/8EAA==<br>data:<br>active: true<br>category: app<br>description: BootManagerMenuApp<br>force_reconnect: false<br>hidden: true<br>paths:<br>- - Fv(7cb8bdc9-f8eb-4f34-aaea-3ee4af6516a1)/FvFile(eec25bdc-67f2-4d95-b1d5-f81b2039d11d)<br>attributes:<br>- NON_VOLATILE<br>- BOOTSERVICE_ACCESS<br>- RUNTIME_ACCESS

Instance port forwarding

A new incus port-forward command makes it easy to access a TCP service running inside of an instance.

The CLI tool runs a local TCP listener and forwards every connection made to it to the given address and port inside of the instance or on a network attached to that instance.

stgraber@vorash:~$ incus port-forward my-nginx 80 8080<br>stgraber@vorash:~$ incus port-forward my-nginx 10.0.3.1:443 0.0.0.0:8443

Reworked authorization configuration

The authorization configuration has moved to a new authorization.* namespace, with the former openfga.* server configuration keys now being authorization.openfga.api.url, authorization.openfga.api.token and authorization.openfga.store.id. Existing values are automatically migrated on upgrade.

This now allows us to support multiple authorization drivers in parallel and chose the provider based on the request type. This is done through a new set of keys:

authorization.client.default: driver for clients...