CVE-2026-3888: Canonical snapd privilege escalation via systemd-tmpfiles interaction

CVE-2026-3888 · Severity: high · CVSS 7.8 · Published 2026-03-17

A vulnerability in snapd, the service that manages application packages (snaps) on Ubuntu Linux, allows a local user to gain full administrative (root) control of the system. The flaw occurs because of an interaction between the snap sandbox manager and a system cleanup utility that automatically deletes old temporary files. By waiting for the system to delete a specific directory and then replacing it with a malicious version, an attacker can trick the system into running their code with elevated privileges. This exploit requires significant time to execute (between 10 to 30 days) but results in a total compromise of the affected machine.

Technologies: Canonical Snapd. Vendors: Canonical.

Quick answers

Is CVE-2026-3888 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-3888 being exploited in the wild.
How severe is CVE-2026-3888?
High severity, with a CVSS score of 7.8, published 17 March 2026.
Which products and versions are affected?
Canonical Snapd prior to 2.73+ubuntu24.04.2.
Is there a fix for CVE-2026-3888?
A patch was published on 2026-03-17: Patched versions released for Ubuntu LTS versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3888 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-3888?
Check whether you run Canonical Snapd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Local Privilege Escalation (LPE) vulnerability exists in snapd due to an insecure interaction between snap-confine and systemd-tmpfiles. On Ubuntu 24.04 and later, systemd-tmpfiles is configured to automatically delete files in /tmp older than 10-30 days. An attacker can wait for this cleanup cycle to delete the /tmp/.snap directory within a snap's private namespace. Because the parent /tmp directory is world-writable, the attacker can recreate /tmp/.snap. When snap-confine subsequently sets up a snap sandbox, it performs bind-mounts into this attacker-controlled directory. By winning a race condition during the 'mimic' creation process, the attacker can force snap-confine to bind-mount malicious shared libraries into the sandbox's /usr/lib, leading to arbitrary code execution as root via SUID binaries. Patches are available in snapd versions 2.73+ and later.

Affected products

  • Canonical snapd prior to 2.73+ubuntu24.04.2
  • Canonical snapd prior to 2.73+ubuntu25.10.1
  • Canonical snapd prior to 2.74.1+ubuntu26.04.1
  • upstream snapd snapd prior to 2.75
  • Canonical Ubuntu Linux 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, 25.10

Timeline

  • 2026-03-17: disclosed: Vulnerability disclosed by Qualys and Canonical
  • 2026-03-17: patched: Patched versions released for Ubuntu LTS versions
  • 2026-03-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.