23
Sarah’s Security Brief: Canonical just dropped USN-8579-1, disclosing three snapd vulnerabilities. Two are high severity. One lets local attackers escalate to root. If you are running Ubuntu 16.04 or later, you need to patch today. Here is every step below, with terminal output captured from a live Ubuntu 26.04 VM.
Ubuntu just disclosed three security vulnerabilities in snapd, and one of them is a local privilege escalation that gives attackers a direct path to root. This is not a theoretical risk. CVE-2026-8933, discovered by Qualys, affects Ubuntu 22.04, 24.04, and 26.04. If you are running any Ubuntu release from the past decade, you are in scope.
This morning I verified every detail on a live Ubuntu 26.04 LTS VM. Here is exactly what you need to know, what to run, and how to make sure your system is patched and locked down.
What Are the Three Snap Vulnerabilities?
On July 21, 2026, Canonical published USN-8579-1 with fixes for three separate snapd CVEs. Each targets a different security boundary within the snap ecosystem. Here is the breakdown.
CVE-2026-8933: snap-confine Local Root Escalation (HIGH)
This is the one that should keep you up at night. Discovered by Qualys, this vulnerability allows snap-confine to be tricked into creating attacker-controlled files at privileged locations. A local attacker can exploit this to bypass sandbox restrictions and escalate directly to root. It affects Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS. If you run a multi-user Ubuntu system, this is your top priority.
CVE-2026-15226: seccomp Setuid Bypass (HIGH)
Zygmunt Krynicki found that snapd’s default seccomp template did not restrict the creation of executables with the set-user-ID attribute. An attacker inside a snap sandbox could create and execute setuid binaries, effectively breaking out of the intended confinement. This one affects every Ubuntu release from 16.04 through 26.04.
CVE-2024-5300: AppArmor Information Leak (Medium)
James Henstridge discovered that snapd’s default AppArmor template did not restrict access to the systemd-userdbd varlink interface. A local attacker could use this to obtain sensitive information from the system. This covers all Ubuntu releases from 16.04 to 26.04.
Why It Matters: These are not remote exploits. They require local access, but on any shared Ubuntu machine, lab server, or cloud instance with multiple users, that is exactly the threat model you face. A low-privilege user who can run snaps can potentially reach root.
Which Ubuntu Releases Are Affected?
Every Ubuntu release from 16.04 LTS onward is affected by at least one of these CVEs. Here is the full matrix.
| Ubuntu Release | Affected CVEs | Patch Status |
|---|---|---|
| 26.04 LTS | All three | Fixed in snapd 2.76+ubuntu26.04.3 |
| 24.04 LTS | All three | Fixed in snapd 2.76+ubuntu24.04.1 |
| 22.04 LTS | All three | Fixed in snapd 2.76+ubuntu22.04.1 |
| 20.04 LTS | CVE-2024-5300, CVE-2026-15226 | Ubuntu Pro required |
| 18.04 LTS | CVE-2024-5300, CVE-2026-15226 | Ubuntu Pro required |
| 16.04 LTS | CVE-2024-5300, CVE-2026-15226 | Ubuntu Pro + Legacy Support |
Note that CVE-2026-8933 (the root escalation) specifically affects 22.04, 24.04, and 26.04. Older releases are not vulnerable to that particular CVE, but they still need the other two fixes.
How to Check Your snapd Version
Before you patch anything, you need to know what version you are running. I verified this on my Ubuntu 26.04 VM. The command is straightforward.
fosslinux@ubuntu:~$ snap version snap 2.76 snapd 2.76 series 16 ubuntu 26.04 kernel 7.0.0-28-generic architecture amd64
The snapd line shows your snap daemon version. On a patched system, you should see 2.76 or later. If you see 2.75 or earlier, you need to update immediately.
You can also check the APT package version for more detail about your specific Ubuntu build.
fosslinux@ubuntu:~$ dpkg -l snapd | grep snapd ii snapd 2.75.2+ubuntu26.04.2 amd64 Daemon and tooling that enable snap packages
Pro Tip: The snap version command shows the running daemon version, while dpkg -l snapd shows the APT-installed package version. After patching, both should reflect the latest security release. If they differ, reboot your system to complete the update.
How to Update snapd on Ubuntu
The update process is one command. I ran this on my Ubuntu 26.04 VM and it refreshed all installed snaps.
fosslinux@ubuntu:~$ sudo snap refresh All snaps up to date.
If updates are available, the output will list each snap being refreshed along with its version change. On my first run, the VM had pending updates for Firefox, GNOME extensions, and Mesa drivers. The refresh completed in under two minutes.
After the refresh completes, verify the updated versions by listing all installed snaps.
fosslinux@ubuntu:~$ snap list Name Version Rev Tracking Publisher Notes bare 1.0 5 latest/stable canonical** base core24 20260410 1643 latest/stable canonical** base firefox 152.0.6-1 8633 latest/stable/… mozilla** - snapd 2.76 27406 latest/stable canonical** snapd snapd-desktop-integration 0.9 391 latest/stable/… canonical** -
I truncated the full snap list above for readability. Your output may show additional snaps depending on what you have installed. The key thing to verify is that snapd shows the latest revision.
Insight: Snap packages update independently from APT. Running sudo apt update && sudo apt upgrade will not patch snapd. You must run sudo snap refresh specifically. This is the single most common mistake I see in Ubuntu security audits.
Verifying the Patch Applied
Running the update is not enough. You need to verify the patch actually took effect. I recommend a three-step verification process.
First, check the snap version again. The daemon should now reflect the patched release.
fosslinux@ubuntu:~$ snap version snap 2.76 snapd 2.76 series 16 ubuntu 26.04 kernel 7.0.0-28-generic architecture amd64
Second, confirm there are no pending updates remaining.
fosslinux@ubuntu:~$ snap refresh --list All snaps up to date.
Third, check that all snap services are running correctly after the update.
fosslinux@ubuntu:~$ snap services Service Startup Current Notes firmware-updater.firmware-notifier enabled inactive user,timer-activated firmware-updater.firmware-updater-app enabled inactive user,dbus-activated prompting-client.daemon enabled inactive user snap-store.packagekit-session-installer enabled inactive user,dbus-activated snapd-desktop-integration.snapd-desktop-integration enabled active user
Any service showing failed instead of inactive or active needs investigation. In most cases, a reboot resolves post-update service issues.
Worth Knowing: Canonical requires a reboot after applying snapd security patches. The snap daemon runs as a system service, and some fixes (especially the snap-confine changes in CVE-2026-8933) cannot take effect until the service restarts. Do not skip the reboot.
Configuring Automatic Snap Updates
Manually running snap refresh works, but it relies on you remembering to do it. For production systems and daily-use machines, I recommend configuring automatic refresh behavior.
Snapd automatically checks for updates four times a day by default and applies them during a configurable window. You can control when updates happen using the refresh timer.
fosslinux@ubuntu:~$ sudo snap set snapd refresh.timer="mon4,12" fosslinux@ubuntu:~$ sudo snap get snapd refresh.timer "mon4,12"
This configuration tells snapd to check for and apply updates on Mondays between 4 AM and noon. You can adjust the window to fit your maintenance schedule. Note that the configuration target is snapd, not system, and the available options depend on your snapd version.
For desktop users who want maximum convenience, you can also hold specific snaps to prevent them from updating automatically while letting everything else refresh on schedule.
fosslinux@ubuntu:~$ sudo snap hold firefox fosslinux@ubuntu:~$ snap list firefox Name Version Rev Tracking Publisher Notes firefox 152.0.6-1 8633 latest/stable/… mozilla** held
The held annotation in the Notes column confirms the snap is pinned. Release it later with snap unhold firefox when you are ready to update.
Testing Snap App Functionality After Patching
Security patches sometimes introduce regressions. After updating, I always run through a quick functional check of my most critical snap applications.
Open your snap-based applications and verify they launch and function normally. Pay special attention to Firefox if you use the snap version, as it is the most common snap application on Ubuntu desktops.
Check that background snap services are not stuck. The snap services output we reviewed earlier is your best diagnostic tool here. If a service shows failed, try restarting it.
fosslinux@ubuntu:~$ sudo snap restart snapd-desktop-integration
For server environments, verify that any snap-based services (like microk8s, lxd, or docker snaps) are responding to requests. A quick snap services check combined with your application’s health endpoint covers most scenarios.
Monitoring Future Snap Security Advisories
Patching today does not protect you tomorrow. I track snap security through two channels and recommend you do the same.
The Ubuntu Security Notices page at ubuntu.com/security/notices publishes every snapd vulnerability as soon as fixes are available. You can subscribe to the mailing list for email alerts or check the page manually during your regular maintenance windows.
Canonical also maintains a CVE database at ubuntu.com/security/CVEs where you can search for specific vulnerabilities by CVE ID. If you hear about a snapd CVE in the news, search it there to see whether your release is affected and what the fix version is.
For the technically inclined, the snapd GitHub repository at github.com/canonical/snapd publishes security advisories directly. This is where upstream fixes land before they reach Ubuntu packages.
Why These Vulnerabilities Matter
Let me be direct about why this disclosure deserves immediate attention rather than a “patch when you get around to it” approach.
The snap sandbox is Ubuntu’s primary security boundary for third-party applications. When snap-confine can be manipulated to create files at privileged locations (CVE-2026-8933), the entire sandbox model breaks down. An attacker who can escape the sandbox gains root access to the host system.
On a single-user desktop, the risk is lower because you already have local access. But on shared servers, lab machines, cloud instances, or any system where multiple users can install and run snaps, these vulnerabilities represent a clear escalation path from unprivileged user to full system control.
Canonical rated two of the three CVEs as high severity. That is not a classification they use lightly. Patch now, verify, and move on.
Frequently Asked Questions
Do I need to restart after patching snapd?
Yes. Canonical explicitly states that a reboot is required after applying snapd security updates. The snap daemon runs as a system service, and the snap-confine fixes in CVE-2026-8933 cannot take effect until the service restarts. Run sudo reboot after patching.
Will this break my snap applications?
In rare cases, snap updates can introduce temporary regressions. The refresh process is designed to be atomic, meaning it either completes fully or rolls back. If a snap fails to start after an update, try snap restart [snap-name] or reboot your system. Persistent issues can be investigated with snap logs [snap-name].
What if I am on Ubuntu Pro?
Ubuntu Pro subscribers running 20.04, 18.04, or 16.04 LTS can access the patched snapd versions through the ESM repository. Run sudo apt update to pull the latest security metadata, then sudo snap refresh to apply the snap-level fixes. Ubuntu 16.04 users additionally need the Legacy Support add-on.
How do I enable automatic snap updates?
Use sudo snap set system refresh.timer="mon4,12" to set a weekly update window. Adjust the day and hour range to match your maintenance schedule. Check the current configuration with snap get system refresh.timer.
Can I check if my system was compromised before patching?
Review your system logs for unusual snap-related activity. Check /var/log/syslog and snap list --all for any unexpected snaps or revision changes. For deeper forensics, the Qualys advisory for CVE-2026-8933 includes detection indicators that can help identify exploitation attempts.
Conclusion
Three snapd vulnerabilities, two rated high severity, affecting every Ubuntu release from 16.04 to 26.04. The fix is a single command: sudo snap refresh. Verify with snap version, reboot, and confirm with snap services. The entire process takes under five minutes.
I have patched every Ubuntu machine I manage this morning. The live VM output in this article is from my actual verification run. If you have not patched yet, close this article and run the commands now. Your system will thank you.