snapd 2.76.1 patches LPE and two sandbox flaws

Qualys has disclosed a local privilege escalation in snapd's snap-confine helper, caused by a capabilities misconfiguration. Tracked as CVE-2026-8933 and scored 7.8 (High), the bug lets an unprivileged local user obtain full root on affected systems. The fix ships in upstream snapd 2.76.1.

The same release closes two related confinement failures. CVE-2024-5300 (5.6 Medium), reported by James Henstridge, is an AppArmor base-profile misconfiguration that lets a confined snap read hashed passwords via systemd-userdbd. CVE-2026-15226 (8.4 High), credited to Zygmunt Krynicki, is a sandbox bypass in snap-confine that omits the setuid restriction from seccomp templates, allowing a confined process to escape intended limits.

Ubuntu is rolling the fixes into every supported release that still carries snapd, from Xenial 16.04 ESM through Resolute 26.04, under series-specific package versions. Eduardo Barretto of the Ubuntu security team announced the trio on the oss-security list and said the corresponding Ubuntu Security Notice is imminent. Systems that install snaps, including default Ubuntu desktop installs, should update promptly.