In russh version 0.65.0, a time-of-check to time-of-use (TOCTOU) vulnerability exists in the agent's asynchronous confirmation process. A sign request for a confirmation-constrained key can complete signing after the agent has been locked by another connection, bypassing the lock state. This occurs because the private key is cloned and held across an await point without revalidating the lock state after confirmation. The flaw violates RFC 9987 section 5.7, which requires suspending private-key signature operations while the agent is locked. The issue is fixed in version 0.65.1.