Change log: https://www.nvidia.com/en-gb/drivers/details/277966/

GNOME Boxes lead developer Felipe Borges has been overhauling the application with a major rewrite and today announced the new beta release. GNOME Boxes has migrated to using the GTK4 toolkit and libadwaita. The new GNOME Boxes code can also handle installing Microsoft Windows 11 now without needing any manual workarounds for Secure Boot or TPM requirements.

The new GNOME Boxes code also introduces a VSOCK device for accessing VM contexts and other improvements. With the revamped GNOME Boxes, it's also shifting to a Flatpak-first and only model for distributing of new GNOME Boxes releases.

Fixes are available for 3 vulnerabilities reported in snapd, each with assigned CVE IDs and CVSS scores.

• CVE-2026-8933, discovered by Qualys, allows local attackers to escalate privileges. It impacts default installations of Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. The CVSS 3.1 score assigned to the vulnerability is 7.8 (high).
• CVE-2026-15226, discovered by Zygmunt Krynicki, Canonical team member, allows local attackers to escape snap confinement from confined root to unconfined root. The CVSS 3.1 score assigned to the vulnerability is 8.4 (high).
• CVE-2024-5300 discovered by James Henstridge, Canonical team member, allows a sandboxed application to access hashed user passwords. This vulnerability impacts installations of Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS Ubuntu, 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS where systemd-userdbd is available. The CVSS 3.1 score assigned to the vulnerability is 5.6 (medium).

Affected releases

The following table lists the affected snaps. Revisions with patches will be updated as they are released.

The snapd package distributed via the Ubuntu archive is also affected in the following releases. Fixes have been released as security updates.

While carbonaceous chondrites make up only a small portion of the meteorites sampled on Earth, CO chondrites make up a very tiny fraction of those meteorites. According to the study, these types of meteorites are among the most pristine materials in our Solar System.

According to the study, the Cretaceous-Paleogene impactor was about six to nine miles wide and created a massive crater in the Yucatán Peninsula in Mexico. It was eventually named the Chicxulub crater.

“Being impacted by such a rare, distant projectile really underscores how unlucky the dinosaurs were,” Claeys said.

As an exciting development for GPU-accelerated video decoding within the Mozilla Firefox web browser, initial support for Vulkan Video has landed in the web browser!

Firefox on Linux has long been focused on the Video Acceleration API (VA-API) that isn't universally supported by Linux graphics drivers. This has left to efforts like NVIDIA-VAAPI-Driver to layer VA-API atop NVIDIA NVDEC interfaces to enjoy GPU-accelerated video playback in Firefox. Smaller Arm/embedded graphics drivers also have been largely left out of the game in the VA-API space. But with Vulkan Video we are beginning to see more adoption and in a cross-platform manner.

The Firefox 153 release due out in July will have Vulkan Video decoding support available. The Vulkan Video activity in Firefox Git culminated this week with the work of NVIDIA engineer Tymur Boiko and Red Hat's Martin Stransky.

First up with Flatpak 1.16.4 is a fix for CVE-2026-34078, which is a security issue allowing a complete sandbox escape leading to host file access and code execution in the host context. Ouch. The issue is due to Flatpak portal accepting paths in the sandbox-expose options that can be app-controlled symlinks pointing at arbitrary paths. Due to this apps can access all host files and can be used as a primitive for gaining code execution in the host context. Disabling Flatpak Portal is another way to workaround this issue but can cause app problems.

CVE-2026-34079 is also fixed and is for preventing arbitrary file deletion on the host file-system. CVE-2026-34079 stems from caching for ld.so removing outdated cache files without checking that the app controlled path to the outdated cache is in the cache directory.

How to check if you are impacted

To get the version of the sudo package installed, run the following command:

dpkg -l 'sudo*' | grep ^ii

The following table lists the fixed versions of the sudo package in all supported Ubuntu releases:

Release	Package	Fixed version
Questing Quokka (25.10)	sudo	1.9.17p2-1ubuntu1.1
	sudo-ldap	1.9.17p2-1ubuntu1.1
	sudo-rs	Not affected
Noble Numbat (24.04 LTS)	sudo	1.9.15p5-3ubuntu5.24.04.2
	sudo-ldap	1.9.15p5-3ubuntu5.24.04.2
Jammy Jellyfish (22.04 LTS)	sudo	1.9.9-1ubuntu2.6
	sudo-ldap	1.9.9-1ubuntu2.6
Focal Fossa (20.04 LTS)	sudo	Not affected
	sudo-ldap	Not affected
Bionic Beaver (18.04 LTS)	sudo	Not affected
	sudo-ldap	Not affected
Xenial Xerus (16.05 LTS)	sudo	Not affected
	sudo-ldap	Not affected
Trusty Tahr (14.04 LTS)	sudo	Not affected
	sudo-ldap	Not affected

Affected sudo versions

How to address

We recommend you upgrade all packages:

sudo apt update && sudo apt upgrade

If this is not possible, the sudo userspace mitigations can be installed directly and does not require a reboot to apply:

sudo apt update
sudo apt install sudo

The unattended-upgrades feature is enabled by default for Ubuntu Xenial Xerus (16.04 LTS) onwards. This service:  

• Applies new security updates every 24 hours automatically.
• If you have this enabled, the patches above will be automatically applied within 24 hours of being available.