Vulnerability Description
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Canonical | Ubuntu Linux | 16.04 |
Related Weaknesses (CWE)
References
- https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888MitigationThird Party Advisory
- https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txtThird Party Advisory
- https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888MitigationThird Party Advisory
- https://ubuntu.com/security/CVE-2026-3888Third Party Advisory
- https://ubuntu.com/security/notices/USN-8102-1Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/03/18/1Mailing ListThird Party Advisory
FAQ
What is CVE-2026-3888?
CVE-2026-3888 is a vulnerability with a CVSS score of 7.8 (HIGH). Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up thi...
How severe is CVE-2026-3888?
CVE-2026-3888 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-3888?
Check the references section above for vendor advisories and patch information. Affected products include: Canonical Ubuntu Linux.