Affected Systems
Ubuntu Desktop 24.04, 25.10, and 26.04 (default installations). Vulnerable component: snap-confine in snapd. Affects systems using the set-capabilities model for privilege enforcement.
Exploitation Status
Proof-of-concept details publicly disclosed by Qualys. No reports of active exploitation in the wild. Requires local user access or code execution to exploit.
Business Impact
Unprivileged local users can escalate to root through a race condition during sandbox initialization. Attackers exploit a narrow window where temporary files under /tmp are owned by the unprivileged user before ownership transfer. By mounting a malicious FUSE filesystem and creating symlinks, attackers inject malicious udev rules and execute arbitrary commands as root. Employee workstations, developer systems, and administrative endpoints running default Ubuntu Desktop are at risk. CVSS 7.8 (High).
Urgency
🟠 Within 24 hours
Recommended Actions
- Apply the latest snapd updates immediately on all Ubuntu Desktop 24.04, 25.10, and 26.04 systems
- Verify installed snapd version manually rather than relying on release age—run 'snap version' and confirm patch status
- Audit systems for unauthorized privilege escalation activity by reviewing /run/udev/rules.d/ for unexpected .rules files and checking systemd-udevd logs for anomalous command execution
- Restrict local user access on sensitive Ubuntu Desktop endpoints, especially developer and administrative workstations
- Monitor for suspicious FUSE mount activity and symlink creation in /tmp during snap-confine execution