CVE-2026-8933: snap-confine Flaw Allows Local Root Escalation on Default Ubuntu Desktop Installs
A high-severity vulnerability tracked as CVE-2026-8933 affects snap-confine within snapd and enables unprivileged local users to obtain root access on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The flaw stems from a hardening change that replaced traditional setuid root with Linux capabilities, inadvertently creating a race condition during sandbox initialization involving temporary files in /tmp, FUSE mounts, and symbolic links. Attackers can chain the issue with malicious udev rules to bypass AppArmor confinement and force systemd-udevd to execute commands as root. Canonical has released patched versions of snapd including 2.76.1 upstream and corresponding Ubuntu packages for multiple releases, along with ESM updates for older systems. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability once local access is obtained. Organizations are advised to deploy the updates immediately on workstations and developer machines while strengthening local execution controls and AppArmor policies.
HispasecJul 23, 2026Translated from Spanish