snap-confine vulnerability in Ubuntu Desktop may give a local user root

Colleagues, I’d like to draw your attention to a cybersecurity issue: CVE-2026-8933 has been discovered in snap-confine for Ubuntu Desktop.

A local unprivileged user may obtain root access and full control over the system.

The issue affects standard installations of Ubuntu Desktop 24.04, 25.10 and 26.04. The attack relies on a race condition, FUSE and symlink manipulation.

An attacker may influence files under /run/udev/** and trigger command execution as root.

Why this matters: if a machine already has local access, this vulnerability can turn it into a full host takeover. I would recommend updating snapd as soon as possible and checking the version across all workstations.

Have you already verified snapd currency in your environment?
#cybersecurity #Ubuntu #Linux #PatchManagement