bubblewrap CVE-2026-41163

Requires bubblewrap version 0.11.0 or 0.11.1 installed with setuid root bit enabled (chmod u+s), which is explicitly NOT the default configuration in mainstream Linux distributions. Attacker must have local shell access with ability to execute bubblewrap commands and spawn ptrace-capable processes under the same UID. Exploitation further depends on winning a race condition during the brief privilege-drop window in bubblewrap's startup sequence. Systems using user-namespace-based bubblewrap (standard on Fedora, Debian, Ubuntu, and most desktop distributions since 2015) are not vulnerable because they never invoke setuid privilege escalation. Kernel must allow ptrace of same-UID processes (Yama LSM ptrace_scope ≤ 1, which is typical default). Does NOT work against non-setuid bubblewrap installations or versions compiled with -Dsupport_setuid=false.

Real-world risk is moderate despite CVSS 8.7 rating. The CVSS v4.0 vector indicates network attack vector (AV:N), but this appears to be a scoring error - the vulnerability requires local access to execute bubblewrap and attach ptrace to the same-UID process. Exploitation prerequisites significantly limit scope: victim system must have bubblewrap installed with setuid bit enabled (chmod u+s), which is NOT the default configuration in mainstream distributions like Fedora, Debian, or Ubuntu that rely on user namespaces instead. The vendor's immediate deprecation of setuid mode and introduction of compile-time disable flag (-Dsupport_setuid=false, now default) demonstrates they view this attack surface as fundamentally insecure rather than patchable. EPSS data not available for 2026 CVE. No CISA KEV listing. Technical impact is high for affected configurations - successful exploitation grants full sandbox escape, allowing confined applications to access host filesystem, network, and processes. However, automatable exploitation is low (requires precise timing to win ptrace race during privilege transitions). Organizations using Flatpak or container tools should verify their bubblewrap is either non-setuid or upgraded to v0.11.2+, then migrate away from setuid mode per vendor guidance.

Local attacker with shell access on a system running setuid bubblewrap 0.11.x launches a sandboxed application via Flatpak or direct bwrap invocation. During the millisecond window when bubblewrap drops root privileges to perform low-privileged namespace setup, attacker's second process (same UID) attaches via ptrace to the dumpable bubblewrap process. Injected code manipulates file descriptor table or mount namespace setup, redirecting sandbox root filesystem to attacker-controlled directory with malicious libraries. Sandboxed application now executes attacker code with access to host system resources, escaping intended confinement. François Diakhate reported this vulnerability, and vendor confirmed ptrace exploitation vector in release notes.