Qualys disclosed CVE-2026-8933, a high-severity Ubuntu flaw that lets local attackers gain root privileges through a race condition in snap-confine.
Qualys has disclosed a high-severity local privilege escalation vulnerability, tracked as CVE-2026-8933 (CVSS score of 7.8), affecting default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The flaw stems from a race condition introduced during a security hardening change in the snap-confine sandbox initialization process. An unprivileged local attacker could exploit the issue to gain root access and take full control of the affected system.
snap-confine is a privileged security component of Snap, Ubuntu’s package and application management system. It is responsible for launching Snap applications inside a sandbox, restricting their access to the rest of the operating system. snapd is the background service (daemon) that manages Snap packages on Linux systems, especially Ubuntu. It installs, updates, removes, and runs Snap applications, while enforcing their security policies.
In recent Ubuntu releases, Canonical moved snap-confine from a traditional setuid-root model to a capability-based approach designed to reduce privileges. However, this change introduced a race condition: during sandbox initialization, snap-confine creates temporary files and directories under /tmp that are briefly controlled by the unprivileged user before ownership is transferred to root.
CVE-2026-8933 exploits this weakness through two race conditions. An attacker can mount a FUSE filesystem over the temporary directory to bypass isolation and create symbolic links targeting sensitive files. When snap-confine writes data, it may follow the malicious link and modify unintended files with elevated privileges. The exploit can then bypass AppArmor restrictions by placing a malicious udev rule in an allowed path, forcing systemd-udevd to execute commands as root. The result is a local privilege escalation that can give an attacker full control of the affected Ubuntu system.
During sandbox initialization, snap-confine creates temporary files and directories in /tmp that are initially controlled by the unprivileged user. A brief race window remains before ownership is transferred to root, allowing potential manipulation.
“CVE-2026-8933 is rated High severity. The exploit leverages two concurrent race conditions.First, an attacker mounts a FUSE filesystem over the temporary scratch directory immediately after creation. This bypasses the mount namespace isolation snap-confine applies later, keeping the directory accessible outside the sandbox.” reads the report by Qualys. “Second, the attacker creates a symlink pointing to an arbitrary target file. When snap-confine attempts to create a sandbox file, the open() call follows the symlink and writes to the target. A second race condition allows the attacker to widen file permissions to 0666 before snap-confine calls fchown() to transfer ownership to root.”
The vulnerability affects Ubuntu Desktop 24.04, 25.10, and 26.04 systems using the updated snapd packages. Users and organizations should install the latest snapd security updates released by Canonical to protect affected systems.
In March 2026, Qualys researchers found a high-severity flaw, tracked as CVE-2026-3888 (CVSS score of 7.8), in Ubuntu Desktop 24.04+, which allows attackers to exploit a systemd cleanup timing issue to escalate privileges to root and potentially take full control of vulnerable systems.
The bug relies on a cleanup window of 10–30 days, but can ultimately lead to full system compromise. It stems from how snap-confine manages privileged execution and how systemd-tmpfiles removes old temporary files.
“The Qualys Threat Research Unit has identified a Local Privilege Escalation (LPE) vulnerability affecting default installations of Ubuntu Desktop version 24.04 and later. This flaw (CVE-2026-3888) allows an unprivileged local attacker to escalate privileges to full root access through the interaction of two standard system components: snap-confine and systemd-tmpfiles.” reads the advisory.
“While the exploit requires a specific time-based window (10–30 days), the resulting impact is a complete compromise of the host system.”
CVE-2026-3888 impacts Ubuntu’s snap system and involves two components: snap-confine and systemd-tmpfiles. snap-confine sets up secure app environments, while systemd-tmpfiles cleans temporary files. The flaw happens when an attacker waits for a key folder to be deleted, then recreates it with malicious files. When snap-confine later initializes a sandbox, it mounts these files as root, enabling privilege escalation. Rated high severity (CVSS score of 7.8), the attack requires local access and timing but can lead to full system compromise, impacting confidentiality, integrity, and availability.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Ubuntu)
