Description
When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may grant additional privileges to a container within the snap that were not originally intended.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Canonical | snapd | < 2.48.3 | 2.48.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | snapd | 2.49-1 | — |
| Debian 13 | snapd | 2.49-1 | — |
| Debian 12 | snapd | 2.49-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | snapd | 2.48.3+20.04 | USN-4728-1 |
| Ubuntu 18.04 LTS | snapd | 2.48.3+18.04 | USN-4728-1 |
| Ubuntu 16.04 LTS | snapd | 2.48.3 | USN-4728-1 |
Advisories 1
- USN-4728-1 snapd vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
References
- https://bugs.launchpad.net/snapd/+bug/1910456 issue-tracking
- https://ubuntu.com/security/notices/USN-4728-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-27352 issue-tracking