Canonical Ubuntu 16.04 LTS up to 24.04 LTS snap-confine sandbox

Summaryinfo

A vulnerability described as very critical has been identified in Canonical Ubuntu 16.04 LTS up to 24.04 LTS. Impacted is an unknown function of the component snap-confine. Such manipulation leads to sandbox. This vulnerability is traded as CVE-2026-15226. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in Canonical Ubuntu 16.04 LTS up to 24.04 LTS. It has been rated as very critical. Affected by this issue is an unknown code block of the component snap-confine. The manipulation with an unknown input leads to a sandbox vulnerability. Using CWE to declare the problem leads to CWE-265. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a strictly confined snap environment can successfully compile or drop binaries and apply setuid properties to them. If a compromised or malicious process inside the snap sandbox executes these generated setuid binaries, it can potentially circumvent architectural sandboxing assumptions, drop intended restriction policies, or execute privileged actions inside the container namespace that should otherwise be strictly blocked. The vulnerability has been resolved by hardening the seccomp template engine to block the execution and creation of setuid executables by sandboxed snap processes.

The advisory is shared for download at ubuntu.com. This vulnerability is handled as CVE-2026-15226 since 07/09/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/21/2026). The MITRE ATT&CK project declares the attack technique as T1611.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Canonical

Name

• Ubuntu

Version

• 16.04 LTS
• 18.04 LTS
• 20.04 LTS
• 22.04 LTS
• 24.04 LTS
• 26.04 LTS

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion