Canonical LXD is susceptible to a critical TOCTOU race condition that permits authenticated attackers to bypass security restrictions when copying instances across projects.

The vulnerability involves a race condition (CWE-367) where restriction checks occur before configuration merging is complete. This allows an authenticated attacker to manipulate instance settings to circumvent security controls.

The ability to bypass project restrictions facilitates the deployment of insecure or high-privilege instances into restricted zones. With a CVSS score of 9.9, the impact on environment integrity is critical, as it undermines the primary security segmentation model provided by LXD projects.

Immediate Action: Apply the vendor-provided security update by upgrading to LXD version 5.0.8 or 5.12.6 or later.

Proactive Monitoring: Monitor API request logs for rapid, repeated instance copy operations that might indicate an attempt to exploit the race condition window.

Compensating Controls: Limit access to the instance copy functionality to highly trusted administrative roles to reduce the attack surface.

Public Exploit Available: Unknown.

The reliance on timing for security checks makes this a high-priority item for remediation. Administrators should move quickly to patch their systems to ensure that configuration validation is performed correctly and atomically.