Fixes are available for 3 vulnerabilities reported in snapd, each with assigned CVE IDs and CVSS scores.
- CVE-2026-8933, discovered by Qualys, allows local attackers to escalate privileges. It impacts default installations of Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. The CVSS 3.1 score assigned to the vulnerability is 7.8 (high).
- CVE-2026-15226, discovered by Zygmunt Krynicki, Canonical team member, allows local attackers to escape snap confinement from confined root to unconfined root. The CVSS 3.1 score assigned to the vulnerability is 8.4 (high).
- CVE-2024-5300 discovered by James Henstridge, Canonical team member, allows a sandboxed application to access hashed user passwords. This vulnerability impacts installations of Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS Ubuntu, 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS where systemd-userdbd is available. The CVSS 3.1 score assigned to the vulnerability is 5.6 (medium).
Affected releases
The following table lists the affected snaps. Revisions with patches will be updated as they are released.
| Snap name | Channel | Remediation status |
|---|---|---|
| snapd | latest/stable | pending (2.76.1) publication |
| snapd | fips-updates/stable | not planned |
| core | latest/stable | pending |
The snapd package distributed via the Ubuntu archive is also affected in the following releases. Fixes have been released as security updates.
| Release | Package Name | Fixed Version |
|---|---|---|
| Xenial (16.04) | snapd | 2.61.4ubuntu0.16.04.1+esm4 |
| Bionic (18.04) | snapd | 2.61.4ubuntu0.18.04.1+esm4 |
| Focal (20.04) | snapd | 2.67.1+20.04ubuntu1~esm3 |
| Jammy (22.04) | snapd | 2.76+ubuntu22.04.1 |
| Noble (24.04) | snapd | 2.76+ubuntu24.04.1 |
| Resolute (26.04) | snapd | 2.76+ubuntu26.04.3 |
How to check if you are impacted
On your system, run the following commands and compare the listed version to the table above.
snap info snapd core
dpkg -l snapd
How to address
You need to update the core and snapd snaps, as well as the snapd Ubuntu package. By default, snaps are automatically updated 4 times a day, but you can also force the refresh manually:
sudo snap refresh snapd
sudo snap refresh core
For Ubuntu packages, the unattended-upgrades feature updates packages once a day by default. If you want to manually apply the security fixes, we recommend you upgrade all packages:
sudo apt update && sudo apt upgrade
If this is not possible, the affected package can be targeted:
sudo apt update && sudo apt install --only-upgrade snapd
The unattended-upgrades feature is enabled by default for Ubuntu 16.04 LTS onwards. This service:
- Applies new security updates every 24 hours automatically.
- If you have this enabled, the patches above will be automatically applied within 24 hours of being available.
How the exploits work
Qualys found that CVE-2026-8933 resulted from switching snap-confine to a new permission system, accidentally creating a security loophole, letting local users gain root access. This vulnerability enables the attacker to create files at certain locations, including /run/udev, by winning these two race conditions:
- snap-confine creates /tmp/snap.rootfs_XXXXXX as an unprivileged user. The attacker can use the time window between creation and ownership change to create a symlink.
- When snap-confine creates the file by following the symlink, the attacker can use the time window between file creation and ownership change to change the file permissions to make it world-writable.
Zygmunt Krynicki discovered that a local attacker with the ability to run arbitrary code as confined root, can use CVE-2026-15226 to create arbitrary suid executables and use them to elevate privileges outside the confinement. The ability to run arbitrary code as confined root can be obtained by either:
- Uploading a malicious snap to the store that purposely uses snap hooks to create the suid, and tricking the user into installing the snap.
- Abusing daemon snaps already present in the target system that legitimately execute user provided programs.
James Henstridge discovered that CVE-2024-5300 allows a snapped application to access the hashed user password via the systemd-userdbd varlink interface.
Acknowledgements
We would like to thank all reporters for responsibly disclosing the issues and for their excellent description.
References
https://ubuntu.com/security/CVE-2026-8933
https://ubuntu.com/security/CVE-2026-15226