Ubuntu systems are at risk from a new local privilege escalation vulnerability in snap-confine, which could enable any local user to gain full root access on certain desktop installations.
Qualys researchers discovered a race condition in snap-confine, the helper program utilized by snapd to prepare the runtime environment for snap applications.
In the affected versions, snap-confine no longer operates as a classic set-user-ID (setuid) root binary but instead relies on Linux capabilities, such as cap_setuid, cap_setgid, cap_sys_admin, and cap_sys_ptrace.
This pivot allows the process to execute with the user’s UID while still maintaining near-root powers. It allows for the temporary creation and manipulation of files owned by unprivileged users.
Ubuntu snap-confine Race Condition Flaw
Only installations of snap-confine configured with capabilities are vulnerable. Default Ubuntu Desktop versions 26.04 and 25.10, as well as the up-to-date Ubuntu Desktop 24.04, are at risk.
These versions use a variant of snap-confine that has capabilities set. Traditional setuid-root installations are not affected by CVE-2026-8933.
The vulnerability arises when snap-confine creates a sandbox for a snap by generating a temporary directory under /tmp named snap.rootfs_XXXXXX using mkdtemp().
It then performs a series of mount operations and replicates a base root filesystem into this temporary directory. Following this, it calls chown() to change the ownership back to root.
However, there’s a brief window during which this temporary directory and any newly created files remain owned by the unprivileged user, creating a race condition.
This pattern also applies to regular files. As snap-confine processes the base root filesystem, it uses open() with flags O_CREAT | O_TRUNC on paths within the scratch directory.
However, since open() does not specify O_NOFOLLOW, it can follow user-controlled symbolic links in this time-sensitive window, thus facilitating exploitable race conditions.
An attacker can exploit this race condition to achieve arbitrary file creation. Once /tmp/snap.rootfs_XXXXXX is created, the attacker mounts a FUSE filesystem over it.
This allows them to unmount any private mount namespaces snap-confine attempts to build, restoring access to their controlled filesystem when snap-confine reaches the file-creation phase.
The attacker can then create a symlink inside the scratch directory that points to a desired target file, using a filename that snap-confine is expected to create (e.g., default256.png for the Firefox snap).
When snap-confine executes open() with its elevated capabilities, it creates the attacker’s chosen file and subsequently changes its ownership to root. The attacker races to set the file mode to 0666, retaining write access even after the ownership change.
Due to restrictions from an AppArmor profile, not all filesystem locations are accessible, limiting arbitrary file creation. However, one writable path is /run/udev/**, processed by systemd-udevd.
According to a Qualys advisory, the exploit places a crafted .rules file in /run/udev/rules.d, causing udev to execute a shell command with root privileges and enabling privilege escalation.
Ubuntu users should monitor and apply security updates from Canonical to address the vulnerability in snap-confine’s handling of temporary directories and other identified weaknesses.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
