Overview
- Qualys disclosed CVE-2026-8933 on July 21, describing a high-severity local privilege escalation in snap-confine that can give an unprivileged user full root on affected systems.
- The bug was introduced after Canonical changed snap-confine from set-UID-root to a set-capabilities model, which left a small race window during sandbox setup that an attacker can exploit.
- Exploitation chains two concurrent races—a FUSE mount over snap-confine’s temporary scratch directory and a symlink/permission race—and drops a malicious udev rule to make systemd-udevd run commands as root.
- The vulnerable set-capabilities snap-confine ships by default in Ubuntu Desktop 26.04, 25.10 and updated 24.04 installs, and Canonical released patches through the Ubuntu Security Team that administrators should apply now.
- Qualys published full technical details and a proof-of-concept and will release detection QIDs, so organizations should inventory devices running snapd, verify versions, deploy updates, and prioritize endpoints where attackers may already have local access.