← Back to CVE List
CVE-2026-3888NVD
Vulnerability Summary
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
CVSS v3.1 Base Metrics
Attack VectorLocal
Attack ComplexityHigh
Privileges RequiredLow
User InteractionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
External References
- https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root
- https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt
- https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888
- https://ubuntu.com/security/CVE-2026-3888
- https://ubuntu.com/security/notices/USN-8102-1
- http://www.openwall.com/lists/oss-security/2026/03/18/1