A vulnerability discovered by Qualys in Ubuntu’s Snap-Confine sandbox component lets unprivileged local users escalate to full root privileges — the ironic result of a change originally meant to tighten security.
Qualys’ Threat Research Unit (TRU) has identified a high-severity Local Privilege Escalation vulnerability in snap-confine, the component responsible for building the execution environment for snap applications on Ubuntu. Tracked as CVE-2026-8933, the flaw affects default installations of Ubuntu Desktop 24.04, 25.10, and 26.04, according to Qualys, allowing an unprivileged local user to obtain full root access.
According to the company, the issue originates from a security hardening change that inadvertently introduced a race condition during sandbox initialization. Canonical had shifted snap-confine from a set-uid-root binary to a set-capabilities model in recent Ubuntu releases to better enforce the principle of least privilege. As a result, snap-confine now runs with the effective UID of the calling user while retaining near-root capabilities. During sandbox setup, the binary creates temporary directories and files under /tmp that are initially owned by the unprivileged user; ownership is transferred to root shortly afterward, but a narrow window remains during which the caller retains full control.
Two concurrent race conditions
Qualys describes an exploit chain that leverages two race conditions running in parallel. First, an attacker mounts a FUSE filesystem over the temporary scratch directory immediately after its creation, bypassing the mount namespace isolation snap-confine applies later and keeping the directory accessible outside the sandbox.
Second, the attacker creates a symlink pointing to an arbitrary target file. When snap-confine attempts to create a sandbox file, its open() call follows the symlink and writes to the target instead. A further race condition allows the attacker to widen file permissions to 0666 before snap-confine calls fchown() to transfer ownership to root.
To bypass AppArmor confinement, the exploit specifically targets the /run/udev/ path, which permits read-write access, according to Qualys. By placing a malicious .rules file under /run/udev/rules.d/ and triggering a FUSE mount/unmount cycle, the attacker forces systemd-udevd to execute arbitrary commands as root.
Affected versions and remediation
According to Qualys, the following Ubuntu releases ship the vulnerable set-capabilities variant of snap-confine by default: Ubuntu Desktop 26.04, Ubuntu Desktop 25.10, and Ubuntu Desktop 24.04 systems updated to current snapd packages. Organizations are advised to apply the latest snapd updates immediately. Canonical has released patches through the Ubuntu Security Team following coordinated disclosure.
Full technical details, including source code references and proof-of-concept execution, are available in a separate Qualys security advisory. The company credits the Ubuntu Security Team — specifically Eduardo Barretto and Zygmunt Krynicki at Canonical — for their coordination, along with the linux-distros community for its collaboration in hardening the snap ecosystem.
Qualys is rolling out detection QIDs via its Vulnerability Knowledgebase, and says its CyberSecurity Asset Management product can identify vulnerable Ubuntu installations running snapd. Qualys Patch Management is intended to automate deployment of relevant patches to affected systems once available.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de