Description
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
snapd
Default version status: unaffected
0 to < 2.75.1affected
Canonical Ubuntu 16.04 LTS
Default version status: affected
2.61.4ubuntu0.16.04.1+esm2 to < *unaffected
Canonical Ubuntu 18.04 LTS
Default version status: affected
2.61.4ubuntu0.18.04.1+esm2 to < *unaffected
Canonical Ubuntu 20.04 LTS
Default version status: affected
2.67.1+20.04ubuntu1~esm1 to < *unaffected
Canonical Ubuntu 22.04 LTS
Default version status: affected
2.73+ubuntu22.04.1 to < *unaffected
Canonical Ubuntu 24.04 LTS
Default version status: affected
2.73+ubuntu24.04.2 to < *unaffected
References
- https://ubuntu.com/security/CVE-2026-3888 ↗
- https://ubuntu.com/security/notices/USN-8102-1 ↗
- https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888 ↗
- https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root ↗
- https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt ↗
- http://www.openwall.com/lists/oss-security/2026/03/18/1 ↗