Ubuntu snap-confine flaw turns any local account into root on default desktops

Qualys disclosed a privilege escalation flaw in snap-confine, the component that builds the sandbox for every snap application. CVE-2026-8933, rated 7.8, affects default installations of Ubuntu Desktop 24.04, 25.10, and 26.04, and stems from a 2025 hardening change that moved snap-confine from a setuid root binary to a capabilities model, introducing a race during sandbox setup. An attacker mounts a filesystem over the temporary scratch directory, plants a symlink so a privileged write lands on another file, then drops a udev rule that makes a system service run commands as root. Fixes shipped July 21.

Check

Update snapd across desktops and developer workstations, and verify the installed snapd version on each machine rather than assuming an older release or prior patching leaves it unaffected.

Affected

Default installations of Ubuntu Desktop 24.04, 25.10, and 26.04 (CVE-2026-8933); anyone with local execution, whether from stolen credentials or a malicious app, can escalate to full root control of the host.

Fix

Install the updated snapd packages, limit local shell access to trusted users until patched, and treat local privilege escalation as urgent since footholds on endpoints are routinely obtained through phishing.