Your message dated Fri, 21 Aug 2026 11:05:53 +0000
with message-id <[email protected]>
and subject line Bug#1142551: fixed in snapd 2.76.3-1
has caused the Debian Bug report #1142551,
regarding snapd: CVE-2026-15226 CVE-2024-5300 CVE-2026-8933
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142551: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142551
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: snapd
Version: 2.76-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for snapd.
CVE-2026-15226[0]:
| A sandbox confinement bypass vulnerability exists in Canonical snapd
| within its internal execution environment compiler (snap-confine).
| The default seccomp security templates generated by the engine to
| restrict system calls do not filter or reject process operations
| capable of creating or manipulating file execution flags with set-
| user-ID attributes. Consequently, an application running within a
| strictly confined snap environment can successfully compile or drop
| binaries and apply setuid properties to them. If a compromised or
| malicious process inside the snap sandbox executes these generated
| setuid binaries, it can potentially circumvent architectural
| sandboxing assumptions, drop intended restriction policies, or
| execute privileged actions inside the container namespace that
| should otherwise be strictly blocked. The vulnerability has been
| resolved by hardening the seccomp template engine to block the
| execution and creation of setuid executables by sandboxed snap
| processes.
CVE-2024-5300[1]:
| An access control bypass and information disclosure vulnerability
| exists in the base AppArmor security profile configuration of
| Canonical snapd. The abstraction rules located in
| /etc/apparmor.d/abstractions/nss-systemd (inherited via )
| inadvertently permit strictly confined snap applications, which lack
| the privileged account-control interface, to interact directly with
| the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX
| domain sockets under /run/systemd/userdb/. On systems where the
| systemd-userdbd service is installed and operational, the service
| fails to distinguish between an unconfined root user on the host
| system and a restricted root user running within a snap
| application's sandbox (such as a daemon or configuration hook).
| Because systemd-userdbd returns "complete" user records—including
| sensitive hashed user passwords from /etc/shadow—when queried by a
| process running as root, a compromised or malicious strictly
| confined snap executing code as root can successfully query the
| Varlink interface to retrieve all system password hashes, bypassing
| intended snap sandbox restrictions. This issue is mitigated by the
| fact that systemd-userdbd is not installed by default on standard
| Ubuntu deployments.
CVE-2026-8933[2]:
| A local privilege escalation vulnerability exists in snap-confine, a
| set-capabilities core component used internally by Canonical snapd
| to construct the secure execution environment for snap applications.
| This vulnerability uniquely affects versions of snap-confine
| configured with set-capabilities (rather than standard set-uid-root
| installations). Due to a flaw in how privilege boundaries or
| security sandboxes are initialized when the binary runs under
| limited ambient capabilities, a local, unprivileged attacker can
| exploit this behavior to bypass intended restrictions and execute
| arbitrary code. Successful exploitation allows the local user to
| elevate their privileges to full root authority.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-15226
https://www.cve.org/CVERecord?id=CVE-2026-15226
[1] https://security-tracker.debian.org/tracker/CVE-2024-5300
https://www.cve.org/CVERecord?id=CVE-2024-5300
[2] https://security-tracker.debian.org/tracker/CVE-2026-8933
https://www.cve.org/CVERecord?id=CVE-2026-8933
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: snapd
Source-Version: 2.76.3-1
Done: Zygmunt Krynicki <[email protected]>
We believe that the bug you reported is fixed in the latest version of
snapd, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Zygmunt Krynicki <[email protected]> (supplier of updated snapd package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 21 Aug 2026 10:45:42 +0000
Source: snapd
Architecture: source
Version: 2.76.3-1
Distribution: unstable
Urgency: medium
Maintainer: Zygmunt Krynicki <[email protected]>
Changed-By: Zygmunt Krynicki <[email protected]>
Closes: 1122720 1136588 1142551
Changes:
snapd (2.76.3-1) unstable; urgency=medium
.
[ Katie May ]
* New upstream release, LP: #2158301
- FDE: support keyboard configuration at install-time for first-boot
- FDE: re-enable passphrases/PINs at install-time
- FDE: require volumes authentication if HWROT is missing
- FDE: bump secboot to rev 457b03a16d19
- FDE: use new secboot API for reprovision TPM
- Cross-distro: modify SELinux policy to use
init_named_socket_activation() for allowing systemd to start snapd
through socket activation
- packaging: make sure that usr/bin/snap is built with correct build
tags on debian sid
- Ensure profiles are setup before running prepare-{slot, plug}*
hooks
.
[ Zygmunt Krynicki ]
* New upstream version 2.76.3
* Not annotated in the Ubuntu changelog but this fixes CVE-2026-15226
(Closes: #1142551)
* debian: add procps to Build-Depends for pidof (Closes: #1136588)
* debian: replace dbus with dbus-daemon in Build-Depends (Closes: #1122720)
* debian: restrict Architecture to known-working arches
* debian: make Zygmunt Krynicki the package maintainer
* debian: update Standards-Version to 4.7.4
Checksums-Sha1:
3c5d60dafc815aa30aed6242ce54276a9704d0cf 3627 snapd_2.76.3-1.dsc
6be0470c41000a6ed695514575ac4162e6f52e5f 8335920 snapd_2.76.3.orig.tar.xz
228138437688b7ef2f0570f1da0a502d2bb9135a 156196 snapd_2.76.3-1.debian.tar.xz
3745df00fd9540816956fa024fe194b0824b710a 13670 snapd_2.76.3-1_source.buildinfo
Checksums-Sha256:
3d0098a8df91a55a91e65caae34b9383f21f671d65fe97fe742643cd715b6d0d 3627
snapd_2.76.3-1.dsc
32456f3d05dd79e91bb8f60b8ea2a78f283a9de57c75af20ce8272607f29cf8b 8335920
snapd_2.76.3.orig.tar.xz
ec27ca821312188277dc86d3f61f71bae915467f3c0ebbc46374118bd49b321f 156196
snapd_2.76.3-1.debian.tar.xz
8c32f37865f6b16a7adddd9bf2342241b901191d538ed86d2b4c3f7de21c47c8 13670
snapd_2.76.3-1_source.buildinfo
Files:
5d443284dac60bef42e1aa3015f7e15a 3627 devel optional snapd_2.76.3-1.dsc
da3f436fece9ed115e3ede7c52b22c03 8335920 devel optional
snapd_2.76.3.orig.tar.xz
0e8bb642fc3e7bea5e81e1fb7617ab7e 156196 devel optional
snapd_2.76.3-1.debian.tar.xz
5b27fc7a519fa25aa63f7d6de7fe9e36 13670 devel optional
snapd_2.76.3-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCgAyFiEEt2ztm0XK8VV9JxpqKJTpOijGe0cFAmqILJsUHHprcnluaWNr
aUBnbWFpbC5jb20ACgkQKJTpOijGe0fwgA//fqlGcl6xB/YdI8aeKOGZ6LCUITfu
SPh1EA/3IXhtOxj01mhoh0TVYt+6v8ozkw6Tv5OTqkK3saYdQ8zECKo0h1MOpeSt
iaoAF5ZgmQMaF2DPmqUSWdZM3PIymmuFmMJeEpdDZZRUSz83123r9JTcinNcbX5T
nI4EmWZHOMNRCboOUiAKaNuRpn9tV6Shb8ftkPGSr1f43QWfEpLKEssnqYCBCYpF
wOYAQzO46OI4lFfy9821xrycpWpfBklRcX64wDEIIJPlGudITts2rKozVwZBzp7v
K0ud2AKjPROIdWcAB9/NHJ6nzr2B/NU0jhS1m3KllNbl+cKPuP+SfSdnx0PAbc4v
tO50y0UV2qfhzGC2xVCS7naYHCUeTQbCeoxNf0la0m5oeTMtdfH50G5cbL3iewqP
cAoTXguebyyCNC0eVwwd4NBgrPgdrH9twAHh/JqnD82UmL7gbqmlMQ9FWgqg6tB1
YqzOKwi1KdKahak2PtUtBpN1QT6DqI5H0ydN3RSkE6ywvy7tERbHxY69cHaw9lr8
E5xiuy+oBru2SnKHtYxXwGwn/C+sHp3Zf+FwswUK/iA5V+u3d9rRSL5vL6ycSlBa
sCox/UmZWS9l0Rbeh492tzDMS/MGqQBGkVaF8udcd4beUCUqKqzd5SzBlvAd5fg/
HGvGLXW84JdmE0Q=
=MMcm
-----END PGP SIGNATURE-----
pgpoC9I9JmBhh.pgp
Description: PGP signature
--- End Message ---
