CVE-2026-41163: Bubblewrap Privilege Escalation Vulnerability

CVE-2026-41163 Overview

CVE-2026-41163 is a privilege escalation vulnerability in bubblewrap, a low-level unprivileged sandboxing tool used by Flatpak and other container runtimes. The flaw affects bubblewrap versions 0.11.0 through 0.11.1 when installed in setuid mode. A local attacker can use ptrace to attach to the bubblewrap process and manipulate the unprivileged portion of the sandbox setup phase. This control allows the attacker to invoke privileged operations, including the overlay mount operation that is otherwise restricted in the setuid configuration. The vulnerability is tracked under [CWE-269: Improper Privilege Management]. Maintainers patched the issue in bubblewrap 0.11.2.

Critical Impact
Local users can hijack the privileged setuid bubblewrap process via ptrace to perform unauthorized overlay mounts, leading to integrity loss on the host system.

Affected Products

bubblewrap versions 0.11.0 through 0.11.1 (setuid installations only)
Linux distributions packaging bubblewrap as setuid in the affected version range
Downstream tools relying on setuid bubblewrap for sandbox isolation

Discovery Timeline

2026-05-09 - CVE-2026-41163 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-41163

Vulnerability Analysis

Bubblewrap is designed to provide unprivileged sandboxing, but some Linux distributions ship it as a setuid binary to support kernels without unprivileged user namespaces. In setuid mode, bubblewrap performs a sandbox setup phase that includes both privileged and unprivileged operations. The vulnerability stems from the unprivileged portion of this setup remaining attachable via ptrace. An attacker running as the invoking user can attach to the bubblewrap process during setup. The attacker then manipulates the process state to drive privileged operations under attacker-controlled inputs. This pathway enables overlay mounts that the setuid build is explicitly designed to block.

Root Cause

The root cause is improper privilege management [CWE-269] during the setuid bubblewrap setup sequence. The process retains attachable state during the unprivileged phase while still possessing the ability to perform subsequent privileged mount operations. Because ptrace access checks treat the bubblewrap process as belonging to the invoking user, the kernel permits attachment. The attacker leverages this to inject controlled values into operations that later execute with elevated privileges.

Attack Vector

Exploitation requires local access as the user invoking bubblewrap. The attacker launches bubblewrap and concurrently attaches a ptrace debugger to the new process before the privileged operations execute. By overwriting memory or registers controlling the mount setup, the attacker requests overlay mounts that bypass the setuid restrictions. No code examples are released by the project for this issue. See the GitHub Security Advisory GHSA-xq78-7hw4-5jvp for the maintainer description.

Detection Methods for CVE-2026-41163

Indicators of Compromise

Unexpected ptrace system calls targeting setuid bwrap processes from non-root users
Creation of overlay mounts originating from user sessions that should not have mount privileges
Audit log entries showing bwrap invocations followed by PTRACE_ATTACH or PTRACE_SEIZE on the same PID

Detection Strategies

Enable Linux audit rules for ptrace syscalls targeting binaries owned by root with the setuid bit set
Monitor mount syscalls with the overlay filesystem type initiated from sandbox processes
Correlate execve of /usr/bin/bwrap with subsequent ptrace activity from sibling processes in the same session

Monitoring Recommendations

Alert on any installed bubblewrap binary with the setuid bit set at a version below 0.11.2
Track package inventory across Linux fleets to identify hosts running affected bubblewrap versions
Review container runtime and Flatpak telemetry for anomalous overlay mount creation events

How to Mitigate CVE-2026-41163

Immediate Actions Required

Upgrade bubblewrap to version 0.11.2 or later on all systems where it is installed setuid
Audit Linux hosts for the setuid bit on the bwrap binary and verify the installed version
Restrict local shell access on systems running affected setuid bubblewrap installations until patched

Patch Information

The issue is fixed in bubblewrap 0.11.2. Refer to the GitHub Bubblewrap Release v0.11.2 for release notes and the GitHub Security Advisory GHSA-xq78-7hw4-5jvp for advisory details. Distribution-provided packages should be updated through the standard package manager once vendor builds are available.

Workarounds

Remove the setuid bit from bwrap where unprivileged user namespaces are available on the kernel
Restrict ptrace scope by setting kernel.yama.ptrace_scope=2 or higher to block cross-process attachment
Limit interactive access to systems where setuid bubblewrap remains deployed pending patching

bash

# Configuration example
# Verify installed bubblewrap version
bwrap --version

# Check whether bwrap is setuid
ls -l $(command -v bwrap)

# Tighten ptrace scope until patched
sudo sysctl -w kernel.yama.ptrace_scope=2
echo 'kernel.yama.ptrace_scope=2' | sudo tee /etc/sysctl.d/10-ptrace.conf

# Remove setuid bit if user namespaces are available
sudo chmod u-s $(command -v bwrap)