Potential LUKS encryption bypass through filesystem confusion

[stgraber (Stéphane Graber)]

So obviously we did find this to be a problem and we have now published a high severity CVE for this along with updated stable images which tighten the TPM bindings to prevent this attack.

Encryption bypass on IncusOS (CVE-2026-32606)

This is a notification that we have published a high severity security fix to IncusOS as build version 202603142010. IncusOS users, particularly those running IncusOS in environments where an attacker could gain physical access to the server without being easily detected, should immediately apply the new stable update. The vulnerability allows for data to be easily extracted even from a fully shutdown IncusOS machine, without needing access to the recovery key or any participation by the machi…