Ubuntu snap-confine race condition grants local attackers root access

A flaw buried deep in Ubuntu's snap system could hand a local user the keys to the entire machine. Qualys researchers have disclosed a race condition in snap-confine—the component that builds sandboxes for snap applications—that allows an unprivileged person sitting at a desktop to escalate their access to full root privileges on Ubuntu Desktop 24.04, 25.10, and 26.04. The vulnerability, tracked as CVE-2026-8933, strikes at the heart of how Ubuntu tried to make its snap system safer.

The story begins with a security decision that backfired. Ubuntu moved snap-confine away from running as a set-uid-root binary—a model where the program itself carries root authority—toward a set-capabilities approach meant to limit how much privilege the component could actually use. Under this newer design, snap-confine runs with the permissions of whoever called it, but retains near-root capabilities to do its job. The intention was sound: narrow the attack surface. What happened instead was the creation of a narrow but exploitable window during sandbox setup.

When snap-confine initializes a sandbox, it creates temporary directories and files under /tmp. For a brief moment during this process, those files are owned by the unprivileged user before ownership transfers to root. That window is where the vulnerability lives. An attacker can exploit two race conditions running in parallel. First, they mount a FUSE filesystem—a user-space filesystem—over the temporary scratch directory after it's created. This keeps the directory accessible from outside the sandbox even after the mount namespace isolation kicks in. Second, the attacker creates a symlink pointing to an arbitrary target file. When snap-confine tries to create a sandbox file, the underlying system call follows that symlink and writes to whatever target the attacker chose.

The exploit goes further. There's a third race condition that lets an attacker widen file permissions to 0666—readable and writable by anyone—before snap-confine transfers ownership to root using fchown(). To slip past AppArmor confinement, the exploit targets /run/udev/**, a path where read-write access is permitted by default. By placing a malicious .rules file in /run/udev/rules.d/ and triggering a FUSE mount and unmount cycle, an attacker can force systemd-udevd to execute arbitrary commands as root. The entire chain turns a local user account into administrative control.

Canonical has released patches through the Ubuntu Security Team following coordinated disclosure with Qualys. The company credited Eduardo Barretto and Zygmunt Krynicki from Canonical, along with the broader linux-distros community, for their work on patch review and hardening. Organizations running affected systems have been urged to apply the latest snapd updates immediately. Qualys has published technical analysis including source code references and proof-of-concept execution, along with guidance for identifying vulnerable machines. Users can search for Ubuntu systems running snapd to locate assets that need patching.

The vulnerability underscores a recurring tension in security engineering: the measures taken to reduce privilege exposure can themselves introduce new risks if implementation details are overlooked. The move away from set-uid-root was meant to shrink the attack surface. Instead, it created a timing gap during sandbox initialization that an attacker could slip through. For security teams managing Ubuntu deployments, the message is clear—patch now, and verify that your systems are running current snapd packages. The flaw affects a core part of the snap packaging system used widely across Ubuntu, making it a priority for anyone running these default desktop installations.