CVE-2026-63297

The EPSS score of 0.00196 fundamentally mischaracterizes this vulnerability's exploitability in multi-tenant environments. The timing flaw during configuration merging isn't an edge-case implementation bug but a structural consequence of how LXD sequences authorization decisions relative to state transitions — this is a state machine sequencing problem where the security-relevant configuration doesn't yet exist in its final form when the authorization decision is rendered. The check passes not because the attacker tricks the system, but because the system is doing exactly what it was designed to do: checking authorization before state transformation. This is structurally different from a permission check bypass and has different implications for remediation and detection. The cross-project boundary is the operative attack surface. LXD's project model is explicitly designed to enforce isolation between tenants. When an instance copy operation spans projects, the source project's configuration state and the target project's restrictions are both in flight simultaneously. The TOCTOU window exists precisely because these two domains must be reconciled, but the reconciliation isn't atomic. An attacker with valid credentials in the source project can leverage this window to inject high-privilege configurations — privileged containers, device access, resource limits — into a target project that should block them. This is an abstraction leak: the instance copy is exposed as an atomic primitive to API consumers, but internally it decomposes into multiple authorization-relevant state transitions that the security model treated as a single operation. The blast radius from one successful exploit radiates forward through every future operation in that project. Every instance spawned from that target project, every resource allocation made against those limits, every device passthrough authorized by those restrictions now operates on attacker-controlled parameters. This is a different risk profile than a transient authentication bypass — the poisoning is persistent. For defenders: verify whether project isolation is enforced at the daemon level or merely at the API layer. If it's the latter, the vulnerability class is more dangerous than the CVSS suggests for anyone using projects as a genuine multi-tenant boundary. The remediation question is whether the fix requires transactional semantics around the entire copy operation or can the check be safely reordered post-merge — but more critically, examine whether the same TOCTOU pattern exists in migration, snapshot, and live configuration update paths where state transitions and authorization are similarly decoupled.

Reviewed through automated stages and approved by a human before publication.