A newly disclosed local privilege escalation vulnerability in Ubuntu’s snap-confine component allows any unprivileged local user to obtain full root access on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04.
Tracked as CVE-2026-8933, the flaw was discovered by the Qualys Threat Research Unit (TRU) and carries a CVSS score of 7.8 (High).
The vulnerability stems from a security hardening change introduced in mid-2025, when Canonical shifted snap-confine from a set-uid-root binary to a set-capabilities model as part of a Principle of Least Privilege initiative.
Ubuntu snap-confine Flaw
While intended to reduce risk, this change means snap-confine now runs with the effective uid of the invoking unprivileged user while retaining near-root capabilities such as cap_sys_admin and cap_dac_override.
As a result, files and directories that snap-confine creates temporarily belong to the unprivileged user rather than root, opening a narrow race-condition window for exploitation.
Attackers can win a race between the moment snap-confine creates a temporary scratch directory (/tmp/snap.rootfs_XXXXXX) and the moment ownership is transferred to root.
During this window, an attacker mounts a FUSE filesystem over the scratch directory to intercept and unmount snap-confine’s subsequent bind and tmpfs mounts, effectively regaining control of the directory.
They then plant a symlink pointing to an arbitrary file target, tricking snap-confine into creating that file with root ownership via an unsafe open() call lacking O_NOFOLLOW protection.
Because snap-confine is confined by AppArmor, attackers cannot write anywhere in the filesystem; however, the profile permits read-write access to /run/udev/**.
By exploiting the arbitrary file creation primitive to drop a malicious .rules file into /run/udev/rules.d containing a PROGRAM= directive, and then triggering a FUSE mount/unmount event, the attacker forces systemd-udevd to execute an arbitrary shell command with full root privileges.
Qualys demonstrated this end-to-end, showing an unprivileged shell escalating to uid=0(root) on both Ubuntu 26.04 and 24.04.3 LTS test systems.
This flaw was disclosed alongside a related kernel ptrace race condition, CVE-2026-46333, which independently permits sensitive information disclosure through timing issues in get_dumpable() logic during privileged process exit, and can be chained with pidfd_getfd() to capture credentials from dying root processes.
Affected Versions and Fixes
| Release | Vulnerable Component | Fixed snapd Version |
|---|---|---|
| Ubuntu 26.04 / 25.10 | System snap-confine (set-capabilities) | 2.76.1 or Ubuntu security update |
| Ubuntu 24.04 LTS | Bundled snap snap-confine | 2.76.1-equivalent Ubuntu package |
| Upstream snapd | All set-capabilities builds | 2.76.1 |
The disclosure timeline shows Qualys reported the issue to Canonical on 2026-04-22, with patches sent to the linux-distros list on 2026-07-13 and a coordinated public release on 2026-07-21.
For CVE-2026-46333, administrators without an operational need for cross-process ptrace debugging can mitigate exposure by setting kernel.yama.ptrace_scope=2 via sysctl.
Organizations running affected Ubuntu Desktop releases should apply snapd updates immediately, as the flaw requires only local, unprivileged access to achieve full root compromise.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
