CVE-2026-3888

Published: Mar 17, 2026Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 1.1 / Impact: 6.0

Source: security@ubuntu.com (Secondary)

Description

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

Affected (5)

Products: Canonical: Ubuntu Linux

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 20.04
Canonical Ubuntu Linux	Version 22.04
Canonical Ubuntu Linux	Version 24.04

Related CWEs

Privilege Chaining

Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.

References (6)

https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root

Source: security@ubuntu.com

MitigationThird Party Advisory

https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt

Source: security@ubuntu.com

Third Party Advisory

https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888

Source: security@ubuntu.com

MitigationThird Party Advisory

https://ubuntu.com/security/CVE-2026-3888

Source: security@ubuntu.com

Third Party Advisory

https://ubuntu.com/security/notices/USN-8102-1

Source: security@ubuntu.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2026/03/18/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.