Home / mailings

PDF

[USN-8579-1] snapd vulnerabilities

Posted on 21 July 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8579-1
July 21, 2026

snapd vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in snapd.

Software Description:
- snapd: Daemon and tooling that enable snap packages

Details:

James Henstridge discovered that snapd's default apparmor template did
not restrict access to systemd-userdbd varlink interface. A local
attacker could possibly use this issue to obtain sensitive information.
(CVE-2024-5300)

Qualys discovered that snap-confine can be tricked to create
attacker-controlled files at certain privileged locations. A local
attacker could possibly use this issue to bypass intended restrictions
and escalate privileges to root. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-8933)

Zygmunt Krynicki discovered that snapd's default seccomp template
did not restrict the creation of executables with the set-user-ID
attribute. A local attacker could possibly use this issue to create
and execute setuid binaries. (CVE-2026-15226)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
snapd 2.76+ubuntu26.04.3

Ubuntu 24.04 LTS
snapd 2.76+ubuntu24.04.1

Ubuntu 22.04 LTS
snapd 2.76+ubuntu22.04.1

Ubuntu 20.04 LTS
snapd 2.67.1+20.04ubuntu1~esm3
Available with Ubuntu Pro

Ubuntu 18.04 LTS
snapd 2.61.4ubuntu0.18.04.1+esm4
Available with Ubuntu Pro

Ubuntu 16.04 LTS
snapd 2.61.4ubuntu0.16.04.1+esm4
Available with Ubuntu Pro

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8579-1
CVE-2024-5300, CVE-2026-15226, CVE-2026-8933

Package Information:
https://launchpad.net/ubuntu/+source/snapd/2.76+ubuntu26.04.3
https://launchpad.net/ubuntu/+source/snapd/2.76+ubuntu24.04.1
https://launchpad.net/ubuntu/+source/snapd/2.76+ubuntu22.04.1

--===============8021832088646768878==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP