Executive brief
A vulnerability in snapd, the service that manages application packages (snaps) on Ubuntu Linux, allows a local user to gain full administrative (root) control of the system. The flaw occurs because of an interaction between the snap sandbox manager and a system cleanup utility that automatically deletes old temporary files. By waiting for the system to delete a specific directory and then replacing it with a malicious version, an attacker can trick the system into running their code with elevated privileges. This exploit requires significant time to execute (between 10 to 30 days) but results in a total compromise of the affected machine.
Technical details
A Local Privilege Escalation (LPE) vulnerability exists in snapd due to an insecure interaction between snap-confine and systemd-tmpfiles. On Ubuntu 24.04 and later, systemd-tmpfiles is configured to automatically delete files in /tmp older than 10-30 days. An attacker can wait for this cleanup cycle to delete the /tmp/.snap directory within a snap's private namespace. Because the parent /tmp directory is world-writable, the attacker can recreate /tmp/.snap. When snap-confine subsequently sets up a snap sandbox, it performs bind-mounts into this attacker-controlled directory. By winning a race condition during the 'mimic' creation process, the attacker can force snap-confine to bind-mount malicious shared libraries into the sandbox's /usr/lib, leading to arbitrary code execution as root via SUID binaries. Patches are available in snapd versions 2.73+ and later.
Affected products
- Canonical snapd prior to 2.73+ubuntu24.04.2
- Canonical snapd prior to 2.73+ubuntu25.10.1
- Canonical snapd prior to 2.74.1+ubuntu26.04.1
- upstream snapd snapd prior to 2.75
- Canonical Ubuntu Linux 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, 25.10
Timeline
- 2026-03-17: disclosed: Vulnerability disclosed by Qualys and Canonical
- 2026-03-17: patched: Patched versions released for Ubuntu LTS versions
- 2026-03-17: advisory
References
- https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root
- https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt
- https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888
- https://ubuntu.com/security/CVE-2026-3888
- https://ubuntu.com/security/notices/USN-8102-1
- http://www.openwall.com/lists/oss-security/2026/03/18/1