Executive brief
A security vulnerability has been identified in snapd, the software manager used in Ubuntu and other Linux distributions to run applications in isolated 'sandboxes.' A flaw in how the system restricts program actions allows a malicious or compromised application to create special files that grant it elevated privileges. This could allow an attacker to bypass security boundaries, access sensitive data, or perform unauthorized actions on the host system that should normally be blocked.
Technical details
A sandbox confinement bypass vulnerability exists in Canonical snapd's 'snap-confine' component. The root cause is a deficiency in the generated seccomp security templates, which fail to block system calls that create or modify files with set-user-ID (setuid) attributes. A local attacker or a compromised process within a strictly confined snap can exploit this by dropping or compiling a binary and applying setuid properties to it. Upon execution, this binary allows the process to bypass architectural sandboxing assumptions and execute privileged actions within the container namespace. The issue is resolved in snapd version 2.76.1 and corresponding Ubuntu package updates by hardening the seccomp engine to block setuid operations.
Affected products
- Canonical snapd < 2.76.1
- Canonical Ubuntu 26.04 LTS < 2.76+ubuntu26.04.3
- Canonical Ubuntu 24.04 LTS < 2.76+ubuntu24.04.1
- Canonical Ubuntu 22.04 LTS < 2.76+ubuntu22.04.1
- Canonical Ubuntu 20.04 LTS < 2.67.1+20.04ubuntu1~esm2
- Canonical Ubuntu 18.04 LTS < 2.61.4ubuntu0.18.04.1+esm3
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched