ISOMAN

CVE

CVE-2026-3888

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

Severity
HIGH
CVSS
7.8
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu24.04.4 amd64 desktopunknownsource
Ubuntu24.04.4 amd64 live-serverunknownsource
Ubuntu24.04.3 amd64 live-serverunknownsource
Ubuntu22.04.5 amd64 desktopunknownsource
Ubuntu22.04.5 amd64 live-serverunknownsource
Ubuntu20.04.6 amd64 desktopunknownsource
Ubuntu20.04.6 amd64 live-serverunknownsource
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource
Ubuntu24.04 amd64 beta-desktopunknownsource
Ubuntu24.04 amd64 beta-live-serverunknownsource
Ubuntu24.04unknownsource
Ubuntu24.04 arm64 beta-live-serverunknownsource
Ubuntu24.04 ppc64el beta-live-serverunknownsource
Ubuntu24.04 riscv64unknownsource
Ubuntu24.04 s390x beta-live-serverunknownsource
Ubuntu24.04 amd64 desktopunknownsource
Ubuntu24.04 amd64 live-serverunknownsource
Ubuntu24.04 arm64 live-serverunknownsource
Ubuntu24.04 ppc64el live-serverunknownsource
Ubuntu24.04 s390x live-serverunknownsource
Ubuntu24.04.1 amd64 desktopunknownsource
Ubuntu24.04.1 amd64 live-serverunknownsource
Ubuntu24.04.1unknownsource
Ubuntu24.04.1 arm64 live-serverunknownsource
Ubuntu24.04.1 ppc64el live-serverunknownsource
Ubuntu24.04.1 riscv64unknownsource
Ubuntu24.04.1 s390x live-serverunknownsource
Ubuntu24.04.2 amd64 desktopunknownsource
Ubuntu24.04.2 amd64 live-serverunknownsource
Ubuntu24.04.2unknownsource
Ubuntu24.04.2 arm64 live-serverunknownsource
Ubuntu24.04.2 ppc64el live-serverunknownsource
Ubuntu24.04.2 riscv64unknownsource
Ubuntu24.04.2 s390x live-serverunknownsource

References

  1. https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root
  2. https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt
  3. https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888
  4. https://ubuntu.com/security/CVE-2026-3888
  5. https://ubuntu.com/security/notices/USN-8102-1
  6. http://www.openwall.com/lists/oss-security/2026/03/18/1