High-Severity Ubuntu Snap Vulnerability Grants Root Access to Local Attackers
Researchers at Qualys have uncovered a critical vulnerability (CVE-2026-8933) in Ubuntu’s snap-confine component, allowing unprivileged local users to escalate privileges and gain full root access on affected systems. The flaw stems from a race condition in the sandbox setup process, introduced after a security hardening change replaced snap-confine’s setuid-root model with a Linux capabilities-based approach.
The vulnerability exploits a brief window during temporary file handling, where an attacker can manipulate file permissions before ownership is transferred to root. By mounting a malicious FUSE filesystem and redirecting file operations via symbolic links, an attacker can inject malicious rules into /run/udev/rules.d/, triggering systemd-udevd to execute commands with root privileges. Successful exploitation grants complete administrative control, enabling file modifications, account creation, security setting changes, and software installation.
The issue affects default installations of Ubuntu Desktop 24.04, 25.10, and 26.04, as well as supported LTS releases (22.04, 24.04, and 26.04). Ubuntu 25.10, which reached end-of-support in July 2026, remains vulnerable unless upgraded. Canonical has released patched snapd versions (2.76+ubuntu26.04.3, 2.76+ubuntu24.04.1, and 2.76+ubuntu22.04.1) to mitigate the flaw.
While exploitation requires local access via compromised credentials, malicious applications, or other vulnerabilities security experts warn that the flaw poses a significant risk for attackers seeking to escalate privileges from an initial foothold. Organizations are advised to update affected systems and verify snapd versions to prevent exploitation.
Source: https://hackread.com/ubuntu-desktop-vulnerability-local-access-root-control/
Canonical cybersecurity rating report: https://www.rankiteo.com/company/canonical
"id": "CAN1784723288",
"linkid": "canonical",
"type": "Vulnerability",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Users of Ubuntu Desktop 24.04, '
'25.10, 26.04, and LTS releases '
'(22.04, 24.04, 26.04)',
'industry': 'Technology/Operating Systems',
'name': 'Canonical (Ubuntu)',
'type': 'Software Vendor'}],
'attack_vector': 'Local',
'description': 'Researchers at Qualys have uncovered a critical vulnerability '
'(CVE-2026-8933) in Ubuntu’s *snap-confine* component, '
'allowing unprivileged local users to escalate privileges and '
'gain full root access on affected systems. The flaw stems '
'from a race condition in the sandbox setup process, '
'introduced after a security hardening change replaced '
'*snap-confine*’s *setuid-root* model with a Linux '
'capabilities-based approach. The vulnerability exploits a '
'brief window during temporary file handling, where an '
'attacker can manipulate file permissions before ownership is '
'transferred to root. By mounting a malicious FUSE filesystem '
'and redirecting file operations via symbolic links, an '
'attacker can inject malicious rules into '
'*/run/udev/rules.d/*, triggering *systemd-udevd* to execute '
'commands with root privileges. Successful exploitation grants '
'complete administrative control, enabling file modifications, '
'account creation, security setting changes, and software '
'installation.',
'impact': {'operational_impact': 'Complete administrative control, enabling '
'file modifications, account creation, '
'security setting changes, and software '
'installation',
'systems_affected': 'Ubuntu Desktop 24.04, 25.10, 26.04, and LTS '
'releases (22.04, 24.04, 26.04)'},
'post_incident_analysis': {'corrective_actions': 'Patch *snapd* to versions '
'2.76+ubuntu26.04.3, '
'2.76+ubuntu24.04.1, or '
'2.76+ubuntu22.04.1',
'root_causes': 'Race condition in *snap-confine* '
'component due to a security '
'hardening change replacing '
'*setuid-root* with Linux '
'capabilities-based approach'},
'recommendations': 'Update affected systems to patched *snapd* versions and '
'verify *snapd* versions to prevent exploitation.',
'references': [{'source': 'Qualys Research'}],
'response': {'containment_measures': 'Canonical released patched *snapd* '
'versions (2.76+ubuntu26.04.3, '
'2.76+ubuntu24.04.1, and '
'2.76+ubuntu22.04.1)',
'remediation_measures': 'Update affected systems to patched '
'*snapd* versions'},
'title': 'High-Severity Ubuntu Snap Vulnerability Grants Root Access to Local '
'Attackers',
'type': 'Privilege Escalation',
'vulnerability_exploited': 'CVE-2026-8933 (Race condition in *snap-confine* '
'component)'}