A newly disclosed vulnerability in the Ubuntu component that isolates snap applications has been found to hand full root access to any local user on default installations of Ubuntu Desktop 24.04, 25.10 and 26.04.
According to new research from the Qualys Threat Research Unit (TRU) published on July 21, the flaw sits in snap-confine, the enforcement component that builds the execution environment for snap applications.
It is tracked as CVE-2026-8933 and rated high severity. It follows a separate snap-confine root-escalation flaw the same team disclosed in the tool four months earlier.
Jason Soroko, senior fellow at certificate lifecycle management (CLM) provider Sectigo, said the root cause carried a lesson beyond the individual bug. Least privilege, he said, “is not a property of a binary alone. It depends on the full sequence of operations around that binary.”
Read more on Linux privilege escalation: CrackArmor Flaws Expose Linux Systems to Privilege Escalation
A Hardening Change That Opened a Window
The exposure originated in a security hardening change. Canonical shifted snap-confine from a set-user-ID-root binary to a set-capabilities model to enforce least privilege in July 2025, so the tool now executes with the calling user’s effective UID while retaining near-root capabilities.
During sandbox setup, Qualys observed how it created temporary directories and files under /tmp initially owned by the unprivileged user, with ownership transferred to root shortly after. A narrow window remained during which the caller retained full control.
The company documented two concurrent race conditions inside that window. The attacker mounted a FUSE filesystem over the scratch directory immediately after creation, bypassing the mount namespace isolation snap-confine applied later and keeping the directory accessible outside the sandbox.
In parallel, a symlink pointed at an arbitrary target file, so a subsequent open() call in snap-confine followed the symlink and wrote to the target. A second race widened file permissions to 0666 before snap-confine transferred ownership to root.
To bypass AppArmor confinement, the exploit dropped a malicious .rules file into /run/udev/rules.d/ and triggered a FUSE mount and unmount cycle. That forced systemd-udevd to execute arbitrary commands as root.
Local Is Not Low Priority
Commenting on the news, Shane Barney, CISO at Keeper Security, said local privilege escalation flaws had a way of “sliding down the priority list because they require local access,” and warned that the habit was worth breaking.
Attackers routinely landed on endpoints through phishing, stolen credentials or misconfigured remote access, he said, and a race condition of this kind turned a limited foothold into complete host compromise.
The Ubuntu Desktop deployment surface underlines the point. Because the affected snapd package ships in default installs of 24.04, 25.10 and 26.04, employee workstations, developer systems and administrative endpoints all fall within the response scope.
Ubuntu 24.04 systems are exposed only if updated to current snapd packages, so administrators need to verify the installed version rather than rely on release age or prior patch status.
Canonical released patches through the Ubuntu Security Team following coordinated disclosure. Full technical detail, including source references and proof-of-concept (PoC) execution, sits in a Qualys security advisory published alongside the blog.
Qualys urged administrators to apply the latest snapd updates immediately.
Image credit: IB Photography / Shutterstock.com
