Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs

Summary

A local privilege escalation vulnerability (CVE-2026-8933) has been disclosed in Ubuntu's snap-confine, allowing unprivileged users to gain root access on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The flaw stems from a race condition during sandbox initialization, enabling attackers to manipulate temporary directories and symlinks to execute arbitrary commands as root. Applying the latest snapd updates is crucial to mitigate this high-severity vulnerability.

Full text

Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Ravie LakshmananJul 22, 2026Linux / Vulnerability Cybersecurity researchers have disclosed details of a new local privilege escalation (LPE) vulnerability in snap-confine that an unprivileged user can trigger to obtain root access and gain complete control of a target environment. The high-severity flaw, tracked as CVE-2026-8933 (CVSS score: 7.8), impacts default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The disclosure comes as 442 security flaws in Linux have been publicized over the past three days. "The issue stems from a security hardening change that inadvertently introduced a race condition during sandbox initialization," Saeed Abbasi, head of Threat Research Unit (TRU) and director of product at Qualys, said. Snap-confine is a program used internally by snapd to construct the execution environment for snap applications. Snapd is the background service or daemon that manages snap packages on Linux systems. Snaps are nothing but a software packaging format devised by Canonical that allows an application to run securely in an isolated sandbox across most Linux distributions. "Snapd runs a sub-process called snap-confine, which is responsible for creating the necessary confinement for the snap," according to Canonical. Although recent Ubuntu releases make use of the set-capabilities model to enforce the principle of least privilege (PoLP) as a way to minimize the attack surface, the changes allow snap-confine to be executed with the effective UID of the calling user, at the same time still retaining near-root capabilities. "During sandbox setup, the binary creates temporary directories and files under /tmp that are initially owned by the unprivileged user," Qualys explained. "Ownership is transferred to the root shortly after, but a narrow window remains during which the caller retains full control." The problem identified by the cybersecurity vendor is the result of two concurrent race conditions - An attacker mounts a malicious FUSE file system over the temporary scratch directory immediately after creation, bypassing the mount namespace isolation applied by snap-confine and keeping the directory accessible outside the sandbox. The attacker creates a symbolic link (aka symlink) pointing to an arbitrary target file, effectively redirecting file operations to sensitive system locations. By manipulating file permissions before the system transfers ownership, the attacker can inject malicious rules into system directories and gain root code execution, Qualys noted. "When snap-confine attempts to create a sandbox file, the open() call follows the symlink and writes to the target," Abbasi said. "A second race condition allows the attacker to widen file permissions to 0666 before snap-confine calls fchown() to transfer ownership to root." "To bypass AppArmor confinement, the exploit targets the /run/udev/** path, which permits read-write access. By dropping a malicious .rules file in /run/udev/rules.d/ and triggering a FUSE mount/unmount cycle, the attacker forces systemd-udevd to execute arbitrary commands as root." To counter the risk posed by CVE-2026-8933, organizations must apply the latest snapd updates as soon as possible. "An attacker still needs user-level access or code execution, but CVE-2026-8933 can turn that foothold into full control of the host," Jason Soroko, Senior Fellow at Sectigo, said in a statement. "Its presence on default Ubuntu Desktop installations makes employee workstations, developer systems, and administrative endpoints part of the response scope." "Ubuntu 24.04 is notable because updated systems can carry the affected snap-confine variant, showing why administrators must verify the installed snapd version instead of relying on release age or prior patch status. With fixes available, rapid deployment and confirmation should take priority." This is not the first time security flaws have been uncovered in the snap-confine component. In February 2022, Qualys detailed another local privilege escalation flaw dubbed Oh Snap! More Lemmings (CVE-2021-44731) that could be abused to gain root privileges by exploiting a race condition in snap-confine's setup_private_mount(). Since then, several other vulnerabilities have come to light, including CVE-2022-3328 (CVSS score: 7.8) and CVE-2026-3888 (CVSS score: 7.8). Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  endpoint security, linux, Open Source, operating system, Patch Management, privilege escalation, Software Security, Ubuntu, Vulnerability ⚡ Top Stories This Week URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365 Meta Files Patent for AI That Can Listen All Day and Track How You're Feeling New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials 11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code ⭐ Featured Resources What Security Teams Must Defend in the New AI Software Supply Chain Identity Fraud Is Changing Fast. See the Attacks Businesses Face in 2026 What 25 Million Alerts Reveal About the Threats SOCs Ignore How to Find and Control Every Script Running Through Your Marketing Stack Modern SASE Guide: Close the Gaps Traditional Network Security Cannot See

Indicators of Compromise

• cve — CVE-2026-8933

Entities