Cybersecurity researchers have disclosed particulars of a brand new native privilege escalation (LPE) vulnerability in snap-confine that an unprivileged consumer can set off to acquire root entry and achieve full management of a goal atmosphere.
The high-severity flaw, tracked as CVE-2026-8933 (CVSS rating: 7.8), impacts default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The disclosure comes as 442 safety flaws in Linux have been publicized over the previous three days.
“The problem stems from a safety hardening change that inadvertently launched a race situation throughout sandbox initialization,” Saeed Abbasi, head of Menace Analysis Unit (TRU) and director of product at Qualys, mentioned.
Snap-confine is a program used internally by snapd to assemble the execution atmosphere for snap purposes. Snapd is the background service or daemon that manages snap packages on Linux techniques. Snaps are nothing however a software program packaging format devised by Canonical that enables an utility to run securely in an remoted sandbox throughout most Linux distributions.
“Snapd runs a sub-process known as snap-confine, which is accountable for creating the mandatory confinement for the snap,” in line with Canonical.
Though current Ubuntu releases make use of the set-capabilities mannequin to implement the precept of least privilege (PoLP) as a technique to reduce the assault floor, the adjustments enable snap-confine to be executed with the efficient UID of the calling consumer, on the identical time nonetheless retaining near-root capabilities.
“Throughout sandbox setup, the binary creates momentary directories and information below /tmp which are initially owned by the unprivileged consumer,” Qualys defined. “Possession is transferred to the basis shortly after, however a slender window stays throughout which the caller retains full management.”
The issue recognized by the cybersecurity vendor is the results of two concurrent race circumstances –
- An attacker mounts a malicious FUSE file system over the momentary scratch listing instantly after creation, bypassing the mount namespace isolation utilized by snap-confine and maintaining the listing accessible exterior the sandbox.
- The attacker creates a symbolic hyperlink (aka symlink) pointing to an arbitrary goal file, successfully redirecting file operations to delicate system areas.
By manipulating file permissions earlier than the system transfers possession, the attacker can inject malicious guidelines into system directories and achieve root code execution, Qualys famous.
“When snap-confine makes an attempt to create a sandbox file, the open() name follows the symlink and writes to the goal,” Abbasi mentioned. “A second race situation permits the attacker to widen file permissions to 0666 earlier than snap-confine calls fchown() to switch possession to root.”
“To bypass AppArmor confinement, the exploit targets the /run/udev/** path, which allows read-write entry. By dropping a malicious .guidelines file in /run/udev/guidelines.d/ and triggering a FUSE mount/unmount cycle, the attacker forces systemd-udevd to execute arbitrary instructions as root.”
To counter the danger posed by CVE-2026-8933, organizations should apply the most recent snapd updates as quickly as attainable.
“An attacker nonetheless wants user-level entry or code execution, however CVE-2026-8933 can flip that foothold into full management of the host,” Jason Soroko, Senior Fellow at Sectigo, mentioned in an announcement. “Its presence on default Ubuntu Desktop installations makes worker workstations, developer techniques, and administrative endpoints a part of the response scope.”
“Ubuntu 24.04 is notable as a result of up to date techniques can carry the affected snap-confine variant, displaying why directors should confirm the put in snapd model as a substitute of counting on launch age or prior patch standing. With fixes obtainable, speedy deployment and affirmation ought to take precedence.”
This isn’t the primary time safety flaws have been uncovered within the snap-confine part. In February 2022, Qualys detailed one other native privilege escalation flaw dubbed Oh Snap! Extra Lemmings (CVE-2021-44731) that might be abused to realize root privileges by exploiting a race situation in snap-confine’s setup_private_mount().
Since then, a number of different vulnerabilities have come to gentle, together with CVE-2022-3328 (CVSS rating: 7.8) and CVE-2026-3888 (CVSS rating: 7.8).
