Qualys researchers have identified a high-severity local privilege escalation vulnerability, tracked as CVE-2026-8933 (CVSS score 7.8), affecting default installations of Ubuntu Desktop versions 24.04, 25.10, and 26.04. The flaw allows an unprivileged local attacker to gain root privileges and take full control of an affected system.
The vulnerability stems from a race condition introduced during a security hardening change in the `snap-confine` sandbox initialization process. `snap-confine` is a privileged security component of Snap, Ubuntu's package and application management system, responsible for launching Snap applications within a restricted sandbox. The `snapd` daemon manages Snap packages, including installation, updates, removal, and enforcement of security policies.
In recent Ubuntu releases, Canonical transitioned `snap-confine` from a traditional setuid-root model to a capability-based approach to reduce privileges. However, this change created a brief window during sandbox initialization where temporary files and directories created under `/tmp` are initially controlled by the unprivileged user before their ownership is transferred to root.
CVE-2026-8933 exploits this weakness through two concurrent race conditions. First, an attacker can mount a FUSE filesystem over the temporary scratch directory immediately after its creation. This bypasses the mount namespace isolation that `snap-confine` applies later, keeping the directory accessible outside the sandbox.
Second, the attacker creates a symbolic link pointing to an arbitrary target file. When `snap-confine` attempts to create a sandbox file, the `open()` call follows this malicious symlink, causing data to be written to the unintended target file with elevated privileges. An additional race condition allows the attacker to widen file permissions to 0666 before `snap-confine` calls `fchown()` to transfer ownership to root.
The exploit can then bypass AppArmor restrictions by placing a malicious `udev` rule in an allowed path. This forces `systemd-udevd` to execute commands as root, ultimately leading to a local privilege escalation and full system compromise.
Canonical has released security updates for the affected `snapd` packages, and users and organizations are advised to install these updates promptly to protect their systems.
This discovery follows a previous high-severity flaw, CVE-2026-3888 (CVSS score 7.8), also found by Qualys researchers in March 2026, affecting Ubuntu Desktop 24.04 and later. That vulnerability involved a timing issue between `snap-confine` and `systemd-tmpfiles`, which cleans temporary files. While requiring a specific cleanup window of 10–30 days, CVE-2026-3888 also allowed unprivileged local attackers to escalate privileges to root by recreating a key folder with malicious files after it was deleted, which `snap-confine` would then mount as root during sandbox initialization.
