Qualys discovered a privilege escalation bug in Ubuntu’s Snap package system that lets local users with standard access gain full root control. The vulnerability, CVE-2026-8933, carries a CVSS score of 7.8 and affects default Ubuntu Desktop installations on versions 24.04, 25.10, and 26.04.
The issue lives in snap-confine, the component that launches Snap applications in restricted sandboxes. Canonical recently changed how snap-confine manages privileges, moving away from the older setuid-root model toward a capability-based approach. That redesign accidentally created a timing gap during sandbox startup where temporary files briefly belong to the unprivileged user before ownership passes to root.
An attacker exploits this by mounting their own filesystem over the temporary directory and planting symbolic links. When snap-confine writes setup data, it follows those links and modifies protected system files with root-level privileges. The attacker can then plant a malicious rule that forces execution of arbitrary commands as root, bypassing AppArmor restrictions entirely.
The attack requires local access and a small timing window, but any successful exploitation results in complete system compromise. This marks the second Snap-related privilege escalation flaw Qualys has found this year after CVE-2026-3888, disclosed in March, which exploited a different race in how systemd handles Snap temporary files. Canonical has released updated snapd packages addressing CVE-2026-8933, and administrators should apply them immediately on affected systems.
