Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs
Summary: Qualys disclosed CVE-2026-8933, a high-severity local privilege escalation flaw (CVSS 7.8) in snap-confine that lets an unprivileged user gain root on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The flaw combines two race conditions during sandbox setup, where temporary files under /tmp are briefly owned by the calling user, allowing an attacker to inject a malicious .rules file into /run/udev/rules.d/ and force systemd-udevd to execute arbitrary commands as root.
What you should know: An attacker still needs a user-level foothold first, but this turns it into full control of the host - and because updated Ubuntu 24.04 systems can still carry the affected snap-confine variant, administrators must verify the installed snapd version rather than trust release age or prior patch status.