On July 21, 2026, Canonical published USN-8579-1, a security notice patching three separate vulnerabilities in snapd — the daemon that manages Snap packages on Ubuntu. Two are rated high severity. One of them turns any local account on a default Ubuntu Desktop install into full root. If you run Ubuntu 22.04 LTS, 24.04 LTS, or 26.04 LTS and haven't updated snapd since July 21, you should do that now.
CVE-2026-8933: Root From Nowhere
The most severe vulnerability, CVE-2026-8933 discovered by Qualys, lives in snap-confine, the binary responsible for setting up the sandbox environment before a Snap application launches. During sandbox initialization, snap-confine creates temporary directories and files under /tmp that are initially owned by the calling unprivileged user. A race condition in that initialization window lets an attacker mount a FUSE filesystem over one of those temporary paths and use a symlink to redirect writes to arbitrary files on the system — including files owned by root.
The CVSS 3.1 score is 7.8 (High). The practical impact on a default Ubuntu Desktop installation: a user with a local account and the ability to run any snap can escalate to root. No special privileges, no pre-installed malware — just a race condition and a FUSE mount. The affected releases are Ubuntu 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS.
CVE-2026-15226: Creating Setuid Binaries Through the Seccomp Template
The second high-severity flaw, found by Zygmunt Krynicki, involves snapd's default seccomp template — the syscall filter applied to contained Snap applications. The template failed to block the chmod and related syscalls needed to create executables with the set-user-ID (setuid) bit. A local attacker inside a confined Snap could craft and execute setuid binaries from within the sandbox, escaping snap confinement from a confined root context into an unconfined root context. Affected: Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS.
CVE-2024-5300: Password Hashes Readable by Sandboxed Apps
The third vulnerability is rated medium, but its reach is remarkable: it affects every Ubuntu LTS release back to Ubuntu 16.04, a decade of installations. A flaw in snap-confine's filesystem isolation allowed sandboxed Snap applications to read hashed user passwords from the host system. Depending on password strength and hashing algorithm, those hashes are potentially crackable offline.
How to Fix It
All three CVEs are patched in the snapd update released on July 21. On any affected Ubuntu release, updating is a two-step process:
sudo apt update
sudo apt install --only-upgrade snapdYou may need to restart the snapd service or reboot for the new snap-confine binary to take effect. The patches apply to Ubuntu 16.04 (via extended security maintenance), 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS.
The Broader Snap Security Picture
This is not the first significant snap-confine vulnerability — a similar race-condition privilege escalation chain, CVE-2026-3888, was patched earlier this year. The pattern suggests that the snap confinement model — which combines seccomp filters, AppArmor profiles, and the snap-confine binary — has attack surface that is proving difficult to fully audit. For shared Ubuntu environments (lab servers, cloud instances with multiple users, developer workstations shared by a team), the calculus is straightforward: update immediately, and treat any local account as a potential privilege escalation vector until you do.