CVE-2026-3888

Local Privilege Escalation in snapd

State: Published
Severity: 7.8 High
Published: Mar 17, 2026
Updated: Mar 18, 2026
Reserved: Mar 10, 2026

Description

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H	canonical

Weaknesses

CWE-268 Privilege chaining

Affected Products

Product	Versions
snapd	before 2.75.1Affected
Ubuntu 16.04 LTSCanonical	2.61.4ubuntu0.16.04.1+esm2 and laterNot affected
Ubuntu 18.04 LTSCanonical	2.61.4ubuntu0.18.04.1+esm2 and laterNot affected
Ubuntu 20.04 LTSCanonical	2.67.1+20.04ubuntu1~esm1 and laterNot affected
Ubuntu 22.04 LTSCanonical	2.73+ubuntu22.04.1 and laterNot affected
Ubuntu 24.04 LTSCanonical	2.73+ubuntu24.04.2 and laterNot affected

References

https://ubuntu.com/security/CVE-2026-3888vdb-entryissue-tracking
https://ubuntu.com/security/notices/USN-8102-1vendor-advisory
https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888technical-descriptionvendor-advisory
https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-roottechnical-descriptionmedia-coverage
https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txttechnical-descriptionmedia-coverage
http://www.openwall.com/lists/oss-security/2026/03/18/1

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.