CVE-2026-3888
Local Privilege Escalation in snapd
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Local Privilege Escalation in snapd
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
- Record
CVE-2026-3888- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-268
- Updated
- 2026-11-02
EUVDEUVD-2026-12570
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
- Record
EUVD-2026-12570- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-grpw-jgrw-ccqr
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re...
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
- Record
GHSA-grpw-jgrw-ccqr- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-268
- Updated
- 2026-11-02
NVD
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
- Record
CVE-2026-3888- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-268
- Updated
- 2026-11-02
OSV
Local Privilege Escalation in snapd
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
- Record
CVE-2026-3888- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-268
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-3888
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
- Record
DEBIAN-CVE-2026-3888- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-3888
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
- Record
UBUNTU-CVE-2026-3888- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-8102-1 No score
snapd vulnerability
Qualys discovered that snapd incorrectly handled certain operations in the snap's private /tmp directory. If systemd-tmpfiles is enabled to automatically clean up this directory, a local attacker could possibly use this issue to re-create the deleted directory, resulting in privilege escalation.
- Record
USN-8102-1- Updated
- 2026-11-02
OSVUSN-8102-2 No score
snapd regression
USN-8102-1 fixed a vulnerability in snapd. The update caused a regresision for Ubuntu 24.04 LTS while installing the package. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Qualys discovered that snapd incorrectly handled certain operations in the snap's private /tmp directory. If systemd-tmpfiles is enabled to automatically clean up this directory, a local attacker could possibly use this issue to re-create the deleted directory, resulting in privilege escalation.
- Record
USN-8102-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
snapdDebian:12 |
before 2.57.6-1+deb12u1, plus listed versions 2.57.6-1 |
2.57.6-1+deb12u1 |
snapdDebian:13 |
before 2.68.3-3+deb13u1, plus listed versions 2.68.3-3 |
2.68.3-3+deb13u1 |
snapdDebian:14 |
before 2.76-1, plus listed versions 2.68.3-32.71-12.71-22.71-32.72-1 Show 5 moreShow less2.73-32.73-42.74.1-12.75.2-12.75.2-2 |
2.76-1 |
snapdUbuntu:Pro:16.04:LTS |
before 2.61.4ubuntu0.16.04.1+esm2, plus listed versions 1.91.9.1.11.9.22.02.0.1 Show 45 moreShow less2.0.22.0.32.0.52.0.82.0.92.0.102.11+0.16.042.12+0.16.042.132.14.2~16.042.15.2ubuntu12.16ubuntu32.17.1ubuntu12.20.1ubuntu12.212.22.22.22.32.22.62.23.12.24.12.252.26.102.27.52.28.52.29.4.22.32.3.22.32.92.33.1ubuntu22.34.22.34.2ubuntu0.12.37.42.37.4ubuntu0.12.382.39.22.39.2ubuntu0.22.402.42.12.45.12.45.1ubuntu0.22.46.12.47.12.482.48.32.54.3+16.04~esm22.54.3+16.04.0ubuntu0.1~esm3 |
2.61.4ubuntu0.16.04.1+esm2 |
snapdUbuntu:Pro:18.04:LTS |
before 2.61.4ubuntu0.18.04.1+esm2, plus listed versions 2.28.5+17.102.29.4.1+18.042.29.4.2+18.042.31.1+18.042.32+18.04~pre5 Show 35 moreShow less2.32+18.04~pre62.32+18.042.32.3.2+18.042.32.5+18.042.32.8+18.042.32.9+18.042.33.1+18.04ubuntu22.34.2+18.042.34.2+18.04.12.37.1+18.042.37.1.1+18.042.37.4+18.042.37.4+18.04.12.38+18.042.39.2+18.042.40+18.042.42.1+18.042.45.1+18.042.45.1+18.04.22.46.1+18.042.47.1+18.042.48+18.042.48.3+18.042.49.2+18.042.51.1+18.042.54.2+18.04ubuntu12.54.3+18.042.54.3+18.04.2ubuntu0.12.54.3+18.04.2ubuntu0.22.55.5+18.042.57.5+18.042.57.5+18.04ubuntu0.12.58+18.042.58+18.04.12.61.4ubuntu0.18.04.1+esm1 |
2.61.4ubuntu0.18.04.1+esm2 |
snapdUbuntu:Pro:20.04:LTS |
before 2.67.1+20.04ubuntu1~esm1, plus listed versions 2.41+19.10.12.42.1+20.042.43.3+git1.8109f82.44~pre1+20.042.44+20.04 Show 28 moreShow less2.44.2+20.042.44.3+20.042.45.1+20.042.45.1+20.04.22.46.1+20.042.47.1+20.042.48+20.042.48.3+20.042.49.2+20.042.51.1+20.04ubuntu22.54.2+20.04ubuntu22.54.3+20.042.54.3+20.04.12.54.3+20.04.1ubuntu0.12.54.3+20.04.1ubuntu0.22.54.3+20.04.1ubuntu0.32.55.5+20.042.57.5+20.042.57.5+20.04ubuntu0.12.58+20.042.58+20.04.12.61.3+20.042.62+20.042.63+20.042.63+20.04ubuntu0.12.65.3+20.042.66.1+20.042.67.1+20.04 |
2.67.1+20.04ubuntu1~esm1 |
snapdUbuntu:22.04:LTS |
before 2.73+ubuntu22.04.1, plus listed versions 2.53+21.10ubuntu12.54.2+22.04ubuntu12.54.2+22.04ubuntu22.54.2+22.04ubuntu32.54.3+git19.g868fc21+22.04 Show 23 moreShow less2.54.3+git26.g360067e+22.042.55.2+22.042.55.2+22.04.12.55.3+22.042.55.3+22.04ubuntu12.55.5+22.042.56.2+22.04ubuntu12.57.4+22.042.57.5+22.042.57.5+22.04ubuntu0.12.58+22.042.58+22.04.12.61.3+22.042.62+22.042.63+22.042.63+22.04ubuntu0.12.65.3+22.042.66.1+22.042.67.1+22.042.68.5+ubuntu22.04.12.71+ubuntu22.042.72+ubuntu22.042.73+ubuntu22.04 |
2.73+ubuntu22.04.1 |
snapdUbuntu:24.04:LTS |
before 2.73+ubuntu24.04.2, plus listed versions 2.60.4+23.102.61.3+24.042.62+24.04build12.63+24.042.63+24.04ubuntu0.1 Show 9 moreShow less2.63.1+24.042.65.3+24.042.66.1+24.042.67.1+24.042.68.5+ubuntu24.04.12.71+ubuntu24.042.72+ubuntu24.042.73+ubuntu24.042.73+ubuntu24.04.1 |
2.73+ubuntu24.04.2 |
snapdUbuntu:25.10 |
before 2.73+ubuntu25.10.1, plus listed versions 2.67.1+25.042.68.5+ubuntu25.10.22.71+ubuntu25.102.71.1+ubuntu25.10.12.72+ubuntu25.10.22.73+ubuntu25.10 |
2.73+ubuntu25.10.1 |
snapdUbuntu:26.04:LTS |
before 2.74.1+ubuntu26.04.3, plus listed versions 2.71.1+ubuntu25.10.12.72+ubuntu26.04.12.73+ubuntu26.04.12.74+ubuntu26.042.74.1+ubuntu26.04 |
2.74.1+ubuntu26.04.3 |
snapdUbuntu:24.04:LTS |
before 2.73+ubuntu24.04.1, plus listed versions 2.60.4+23.102.61.3+24.042.62+24.04build12.63+24.042.63+24.04ubuntu0.1 Show 8 moreShow less2.63.1+24.042.65.3+24.042.66.1+24.042.67.1+24.042.68.5+ubuntu24.04.12.71+ubuntu24.042.72+ubuntu24.042.73+ubuntu24.04 |
2.73+ubuntu24.04.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Local Privilege Escalation in snapd | 2026-03-17 |
| PoC in GitHub | AlanNewberry/CVE-2026-3888-snap-confine-privilege-escalation | 2026-10-06 |
| PoC in GitHub | DanielTangnes/CVE-2026-3888 | 2026-03-31 |
| PoC in GitHub | Many-Hat-Group/Ubuntu-CVE-2026-3888-patcher | 2026-03-19 |
| PoC in GitHub | TheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE | 2026-03-23 |
| PoC in GitHub | alinpfan/CVE-2026-3888-PoC | 2026-10-12 |
| PoC in GitHub | fevar54/CVE-2026-3888-POC-all-from-the-Qualys-platform. | 2026-03-18 |
| PoC in GitHub | hewhomusntbenamed/CVE-2026-3888-fixed | 2026-05-12 |
| PoC in GitHub | netw0rk7/CVE-2026-3888-PoC | 2026-03-20 |
| PoC in GitHub | noambouillet/CVE-2026-3888 | 2026-03-23 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-3888 is a high vulnerability (CVSS 7.8) in Canonical Ubuntu 16.04 Lts, published March 17, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in snapd 2.57.6-1+deb12u1.
References
ubuntu.com/security/CVE-2026-3888
discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888
blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root
cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt
openwall.com/lists/oss-security/2026/03/18/1
Show 15 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-3888
github.com/advisories/GHSA-grpw-jgrw-ccqr
launchpad.net/ubuntu/+source/snapd
security-tracker.debian.org/tracker/CVE-2026-3888
cve.org/CVERecord?id=CVE-2026-3888
Left out here: 4 versions. The JSON record has them.