Executive brief
A security flaw in the snap-confine component of Canonical's snapd service could allow a local user to gain full administrative (root) control over a Linux system. This component is responsible for creating secure environments for applications, but a bug in how it handles permissions allows an attacker to bypass these protections. This could lead to unauthorized access to sensitive data, system-wide outages, or the installation of malicious software.
Technical details
A local privilege escalation vulnerability exists in snap-confine, a core component of Canonical snapd used to construct secure execution environments. The flaw resides in the initialization of privilege boundaries and security sandboxes when the binary is configured with set-capabilities and runs under limited ambient capabilities. A local, unprivileged attacker can exploit this logic error to bypass intended restrictions and execute arbitrary code with full root privileges. The vulnerability specifically affects installations using set-capabilities rather than the standard set-uid-root configuration. Patches have been released for snapd and various Ubuntu LTS versions.
Affected products
- Canonical snapd 2.75.0 to 2.76.1
- Canonical Ubuntu 26.04 LTS versions prior to 2.76+ubuntu26.04.3
- Canonical Ubuntu 24.04 LTS versions prior to 2.76+ubuntu24.04.1
- Canonical Ubuntu 22.04 LTS versions prior to 2.76+ubuntu22.04.1
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched