In a nutshell: A race condition in snap-confine allows local attackers to gain root access by exploiting FUSE filesystems and symbolic links.
Researchers at the Qualys Threat Research Unit have discovered a security vulnerability (CVE-2026-8933, CVSS 7.8) in snap-confine on Ubuntu that enables local users to obtain root privileges. Ubuntu 24.04, 25.10 and 26.04 are affected.
The snap-confine component is used by the snapd background service to create isolated execution environments for snap applications. The developers replaced the set-UID-root model with set-capabilities to reduce system privileges. However, this hardening measure inadvertently introduced a race condition during sandbox initialization.
In the new implementation, snap-confine runs with the effective user ID of the calling user but retains elevated system privileges. When setting up the sandbox, temporary directories are created under /tmp that initially belong to the unprivileged user before ownership is transferred to root. An attacker can mount a crafted FUSE filesystem immediately after a temporary directory is created, thereby bypassing mount namespace isolation. The attacker then sets a symbolic link to a sensitive system file.
The exploit exploits two simultaneous race conditions. When snap-confine attempts to create a sandbox file, the open() call follows the symlink and writes to the target. A second race condition allows the attacker to extend file permissions to 0666 before snap-confine calls fchown(). To circumvent AppArmor restrictions, the exploit targets /run/udev/, where the attacker places a malicious .rules file. Through a FUSE mount/unmount cycle, systemd-udevd is forced to execute arbitrary commands as root.
Canonical has released corrected snapd packages. Administrators of systems running Ubuntu 24.04, 25.10 and 26.04 should check and update their installed snapd versions. While the attacker requires initial user access or code execution capability, CVE-2026-8933 transforms this initial access into complete host control.
Source: www.it-daily.net · Published 24 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.