Nine critical security vulnerabilities, most enabling arbitrary file read or write on the host through crafted images and path traversal, make Incus 7.3 an urgent upgrade. The fixes address symlink attacks in backup and image imports (CVE-2026-63125, CVE-2026-63343), argument injection through storage volume options (CVE-2026-62867), project restriction bypasses via migration and cross-project copy, and newline injection through OCI DNS config and NVIDIA driver capabilities. Thirteen issues total were patched, with nine rated critical and two high.

Beyond the security work, the headline feature is a new native-context GPU type that lets multiple virtual machines share a single GPU with 3D acceleration. It uses virglrenderer and virtio-gpu to provide hardware-accelerated graphics without dedicating the entire device to one VM through passthrough. Currently only Linux guests have full driver support, so Windows VMs remain unaccelerated. For anyone running GPU workloads across multiple VMs on a single host, this removes the need for expensive multi-GPU setups or SR-IOV capable hardware.

A new incus port-forward command simplifies accessing services inside instances by running a local TCP listener that forwards connections to a given address and port within the container or VM. UEFI NVRAM is now directly manageable through incus low-level nvram, allowing read and write access to boot entries and configuration variables on stopped VMs, with a dedicated rebuild-nvram repair action for resetting to a clean state. The authorization system has been reworked into a per-client-type model where Unix socket, TLS, restricted TLS, and OIDC clients can each use independent authorization drivers, including a new scriptlet option alongside the existing OpenFGA integration.

Smaller additions round out the release: incus list --all-remotes aggregates instances from every configured remote into a single view, I/O limits on disk and unix-block devices now accept simultaneous byte/s and IOPS caps, storage pool usage is exposed through the metrics endpoint for Prometheus-style monitoring, and ARM big.LITTLE CPU cluster topology is now reported and validated correctly. Native MSI and PKG installers for the client tool ship with the release for Windows and macOS, though neither is signed yet. Incus 7.3 is available now through distribution packages and Homebrew.