Hello LXD maintainers, I am requesting a backport of the upstream fix for CVE-2026-63300 to Trixie. Restricted LXD projects let an operator delegate instance creation while blocking settings that expose the host or protected resources. Trixie's LXD implements a cross-project move as an internal copy, but does not apply the target project's normal creation check to the copied configuration or devices. The instance is not revalidated when it starts. A project-scoped HTTPS client can therefore carry blocked `raw.lxc` host hooks, host-path devices, hardware, or network access into the target. Those settings can execute as host root or expose resources that the target policy was meant to protect. I reproduced this through the daemon HTTPS API with a client certificate restricted to the source and target projects. Direct creation of a container with `raw.lxc=lxc.apparmor.profile=unconfined` in the target was rejected, but moving the same instance from the source succeeded and preserved that config. Canonical's advisory and patches are: https://github.com/canonical/lxd/security/advisories/GHSA-5g5r-wh97-qcq2 https://github.com/canonical/lxd/pull/18605 https://github.com/canonical/lxd/commit/ba6e583b7a417fbe4043e3abdfb922a1fe6494f7 https://github.com/canonical/lxd/pull/18821 https://github.com/canonical/lxd/commit/8d122a86c4f52c088c341ebbce0cdc5070876b43 The attached patch is an adapted backport, rather than a byte-for-byte copy: Trixie's older 5.0.2 source predates prerequisite upstream refactoring. It puts the same target-project AllowInstanceCreation and AllowSnapshotCreation checks at the common copy path. It also follows these related stable-5.0 hardening commits for cross-project copy and backup snapshot restore: https://github.com/canonical/lxd/commit/16685963288b88179ef58451e2f0d7ede31037e2 https://github.com/canonical/lxd/commit/e9506926a0c42a61f7f624a2d3c6fbf9c7bd3e1c It applies cleanly to Trixie, preserves source behavior, rejects the PoC, and also validates the related cross-project copy and snapshot restore paths. Could this be included in a Trixie security update? AI tools were used to assist this research and draft. The attached patch and its PoC were manually validated against Trixie. Regards, Artem Dinaburg Trail of Bits