Get on Slack/Teams RSS
Last updated: August 19, 2026 at 1:47 AM UTC
All 741 Vulnerability 286 Breach 129 Threat 319 Defense 7
Tag: ubuntu (2 articles)Clear
vulnerability
CVE-2026-8933
2026-07-23

Ubuntu snap-confine flaw turns any local account into root on default desktops

Qualys disclosed a privilege escalation flaw in snap-confine, the component that builds the sandbox for every snap application. CVE-2026-8933, rated 7.8, affects default installations of Ubuntu Desktop 24.04, 25.10, and 26.04, and stems from a 2025 hardening change that moved snap-confine from a setuid root binary to a capabilities model, introducing a race during sandbox setup. An attacker mounts a filesystem over the temporary scratch directory, plants a symlink so a privileged write lands on another file, then drops a udev rule that makes a system service run commands as root. Fixes shipped July 21.

ubuntusnap-confineprivilege-escalationapparmorrace-condition
Check
Update snapd across desktops and developer workstations, and verify the installed snapd version on each machine rather than assuming an older release or prior patching leaves it unaffected.
Affected
Default installations of Ubuntu Desktop 24.04, 25.10, and 26.04 (CVE-2026-8933); anyone with local execution, whether from stolen credentials or a malicious app, can escalate to full root control of the host.
Fix
Install the updated snapd packages, limit local shell access to trusted users until patched, and treat local privilege escalation as urgent since footholds on endpoints are routinely obtained through phishing.
vulnerability
CVE-2026-41651
2026-04-22

12-year-old 'Pack2TheRoot' bug in PackageKit gives any local user root on default Ubuntu, Debian, Fedora, and RHEL/Cockpit installs (CVE-2026-41651)

Deutsche Telekom's Red Team disclosed CVE-2026-41651, a local privilege escalation in the PackageKit daemon that has shipped in default Linux installations since November 2014. Any unprivileged local user can invoke 'pkcon install' without a polkit prompt, install or remove arbitrary packages, and escalate to root. CVSS 8.8. Confirmed-vulnerable defaults include Ubuntu Desktop and Server LTS, Debian Trixie, Rocky Linux 10.1, and Fedora 43; any RHEL server running Cockpit is also exposed because Cockpit loads PackageKit on demand via D-Bus. PackageKit 1.3.5 fixes it. The researchers credited Anthropic's Claude Opus with helping guide the discovery.

pack2therootpackagekitlinuxprivilege-escalationubuntudebianfedorarhelcockpitdeutsche-telekomclaude-opus
Check
Inventory every Linux endpoint and server for PackageKit, patch to 1.3.5 today, and audit historical journalctl output for the assertion-failure IoC.
Affected
PackageKit versions 1.0.2 through 1.3.4 (every release between November 2014 and the April 22, 2026 fix). Default Ubuntu Desktop and Server LTS, Debian Trixie 13.4, Rocky Linux 10.1, Fedora 43. Plus any RHEL or CentOS server running Cockpit, which loads PackageKit on demand via D-Bus.
Fix
Update PackageKit to 1.3.5 across the fleet. Verify with 'dpkg -l | grep packagekit' or 'rpm -qa | grep packagekit'. A process-list grep is insufficient because PackageKit is D-Bus-activated. Hunt past exploitation via 'journalctl -u packagekit | grep emitted_finished' for assertion-failure crashes. Where patching is delayed, mask the systemd unit and disable Cockpit.