Time-of-check Time-of-use (TOCTOU) Race Condition in LXD - CVE-2026-63297
Published: August 1, 2026
LXD
Detailed vulnerability description
The vulnerability allows a remote user to bypass project restrictions and achieve host escape.
The vulnerability exists due to a time-of-check time-of-use race condition in cross-project instance copy handling in cmd/incusd/instances_post.go when copying an instance across projects and merging source configuration after restriction validation. A remote user can send a crafted instance copy request to bypass project restrictions and achieve host escape.
Exploitation requires the ability to view a source instance in a less-restricted project and create instances in a restricted target project, and the source instance must contain dangerous configuration such as security.privileged, raw.lxc, or raw.apparmor.