Ubuntu Snap-Confine Flaw Lets Local Users Gain Root Access

A CVSS score of 7.8 out of 10 and root access at the end of the chain: that is what lies behind CVE-2026-8933, a new flaw in snap-confine that allows a regular local user to gain root privileges on Ubuntu. Ironically, the vulnerability stems from a change that was meant to improve security. Here is what we know.

On July 21, 2026, the Qualys Threat Research Unit published the details of a local privilege escalation flaw affecting the snap-confine package, the component responsible for building the isolated runtime environment for Snap applications on Ubuntu. That same day, Canonical posted its security bulletin to patch a set of vulnerabilities, including this one.

As a reminder, Snap is the universal package format developed by Canonical, the company behind Ubuntu. It relies on the snapd service, which handles application installation and confinement inside a sandbox. For each application, snapd invokes snap-confine to set up that sandbox.

Two race conditions to go from a regular account to root

In recent versions, Canonical evolved snap-confine from a setuid root binary to a capabilities-based model, with the goal of enforcing the principle of least privilege. This change reportedly dates back to July 2025. Following that modification, the snap-confine package now runs with the calling user's effective UID, while retaining capabilities close to those of root.

As Saeed Abbasi, Threat Research Unit manager at Qualys, explains: "The issue comes from a security hardening change that inadvertently introduced a race condition during sandbox initialization". In practice, while the sandbox is being prepared, the binary creates temporary directories and files under /tmp, initially owned by the unprivileged user. Ownership is transferred to root shortly after, but a narrow window remains during which the caller still has control.

That is the window the exploit targets, by combining two race conditions:

• The attacker mounts a FUSE filesystem over the temporary directory right after it is created. This maneuver bypasses the mount namespace isolation that snap-confine applies afterward, and keeps the directory accessible outside the sandbox.
• The attacker creates a symbolic link (symlink) pointing to an arbitrary target file. When snap-confine tries to create a sandbox file, the open() call follows the symlink and writes to the target. A second race condition then makes it possible to widen the file permissions to 0666 before snap-confine runs fchown() to transfer ownership to root.

The final stage of the attack is to bypass AppArmor confinement. To do so, the exploit targets the /run/udev/ path, which allows read-write access. By dropping a malicious .rules file into /run/udev/rules.d/ and then triggering a FUSE mount and unmount cycle, the attacker forces systemd-udevd to execute arbitrary commands as root. And just like that, the job is done!

The mechanisms abused here — capabilities, mounts, and symbolic links — are not new in Linux privilege escalation. To understand how legitimate functions and binaries can be turned against the system, our article on the GTFOBins project and dangerous Linux misconfigurations is a good refresher.

Three vulnerabilities patched by Canonical

Canonical's security bulletin is not limited to CVE-2026-8933. It fixes three vulnerabilities in snapd:

• CVE-2026-8933 (CVSS 3.1 score of 7.8, important): the privilege escalation flaw discovered by Qualys and discussed in this article.
• CVE-2026-15226 (CVSS 3.1 score of 8.4, important): discovered by Zygmunt Krynicki of Canonical, it allows an attacker who can execute code as confined root to escape confinement and become unconfined root by creating arbitrary suid executables.
• CVE-2024-5300 (CVSS 3.1 score of 5.6, medium): discovered by James Henstridge of Canonical, it allows a confined application to access users' password hashes through the systemd-userdbd varlink interface.

According to Canonical's official bulletin, CVE-2026-8933 affects default installations of Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. Qualys also mentions Ubuntu Desktop version 25.10. What really matters, though, is checking the installed snapd version rather than the Ubuntu version.

As for the fixes, Canonical has released the following snapd versions through the Ubuntu archive:

• Ubuntu 22.04 (Jammy) : 2.76+ubuntu22.04.1
• Ubuntu 24.04 (Noble) : 2.76+ubuntu24.04.1
• Ubuntu 26.04 (Resolute) : 2.76+ubuntu26.04.3

How can you protect yourself from these vulnerabilities?

To take the necessary steps on your machine, follow the instructions below.

Step 1: check whether you are affected. Compare the installed versions against the list above using these two commands:

snap info snapd core
dpkg -l snapd

Step 2: update the snaps. Canonical notes that snaps are refreshed automatically four times a day, but you can force the operation:

sudo snap refresh snapd
sudo snap refresh core

Step 3: update the system package. Canonical recommends updating all packages:

sudo apt update && sudo apt upgrade

If that is not practical, the affected package can be updated on its own:

sudo apt update && sudo apt install --only-upgrade snapd

Exploiting CVE-2026-8933 still requires local access, or an attacker able to run code on the machine. But on desktops where users install and run snaps, this kind of flaw is a real risk. The patch is available, so install it.

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio