Ubuntu snap-confine vulnerability grants root access

A critical vulnerability in Ubuntu's snap-confine component has been disclosed, potentially granting full root access to local users on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The flaw, tracked as CVE-2026-8933, was detailed in new research by the Qualys Threat Research Unit, according to a recent report by Infosecurity Magazine.

The vulnerability stems from a security hardening change made in July 2025, where snap-confine shifted to a set-capabilities model. This created a narrow window during the sandbox setup where a race condition could be exploited. Attackers could mount a FUSE filesystem over a temporary directory, bypass isolation, and use a symlink to write to arbitrary files. A secondary race condition widened file permissions before ownership was transferred to root. The exploit could also bypass AppArmor confinement by dropping a malicious rules file, forcing systemd-udevd to execute commands as root.

This local privilege escalation flaw affects a wide range of Ubuntu Desktop systems, including workstations and administrative endpoints, as the affected snapd package is included in default installations. Qualys urges administrators to apply the latest snapd updates immediately.

Source: Infosecurity Magazine