Ubuntu snap-confine Flaw CVE-2026-8933 Gives Local Users Root on Default Desktop Installs

Cybersecurity researchers have disclosed a high-severity local privilege escalation (LPE) vulnerability in snap-confine, tracked as CVE-2026-8933 (CVSS score: 7.8), that allows an unprivileged user to gain root access on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The flaw stems from a race condition introduced during sandbox initialization, enabling attackers to bypass mount namespace isolation and AppArmor confinement.

Qualys researchers identified two concurrent race conditions: an attacker mounts a malicious FUSE file system over a temporary directory to keep it accessible outside the sandbox, and creates a symbolic link to redirect file operations to sensitive system locations. By manipulating file permissions before ownership transfer, the attacker can inject malicious rules into system directories and achieve root code execution. The exploit targets the /run/udev/** path to drop a malicious .rules file, forcing systemd-udevd to execute arbitrary commands as root.

Organizations must apply the latest snapd updates immediately. This is not the first snap-confine flaw; previous vulnerabilities include CVE-2021-44731 (Oh Snap! More Lemmings), CVE-2022-3328, and CVE-2026-3888. The disclosure comes amid 442 other Linux security flaws publicized in the past three days.