CVE-2026-3888: Ubuntu Snap Privilege Escalation to Root

TL;DR

A high-severity vulnerability (CVSS 7.8) in Ubuntu Desktop 24.04+ allows any unprivileged local user to gain full root access. The exploit abuses a timing gap between two trusted system components — snap-confine and systemd-tmpfiles. Patch now.

What Happened?

Qualys Threat Research Unit just dropped a bombshell: default Ubuntu Desktop installations from 24.04 onward ship with a privilege escalation bug that's been hiding in plain sight.

The vulnerability, tracked as CVE-2026-3888, doesn't require any special permissions, no user interaction, and no exotic software. All it needs is patience — between 10 and 30 days, depending on your Ubuntu version.

The Two Components at Play

1. snap-confine

This is the setuid root binary that builds the sandbox before any snap application runs. It handles mount namespace isolation, cgroup enforcement, AppArmor policy loading, and seccomp filtering. Because it operates with elevated privileges at a critical trust boundary, any flaw here is a big deal.

2. systemd-tmpfiles

This utility manages the lifecycle of volatile directories like /tmp, /run, and /var/tmp — creating them at boot and cleaning out stale files on a timer. The cleanup schedule is the key to this exploit.

How the Attack Works

Here's the exploit chain, step by step:

Day 0:  Attacker logs in as unprivileged user
        ↓
Day 10-30: systemd-tmpfiles deletes /tmp/.snap (stale cleanup)
        ↓
Attacker: Recreates /tmp/.snap with malicious payloads
        ↓
Next snap launch: snap-confine bind-mounts the malicious
                  directory as root → arbitrary code execution
        ↓
Result: Full root access

The beauty — and danger — of this attack is its simplicity. No memory corruption. No kernel exploit. Just two legitimate system services stepping on each other's toes at the wrong time.

Property	Value
Vector	Local
Complexity	High (time-dependent)
Privileges Required	Low (any user)
User Interaction	None
Scope	Changed (escapes component boundary)
Impact	Complete (C:H / I:H / A:H)
CVSS Score	7.8

Who's Affected?

Ubuntu Version	Vulnerable snapd	Patched Version
24.04 LTS	< 2.73+ubuntu24.04.1	2.73+ubuntu24.04.1
25.10 LTS	< 2.73+ubuntu25.10.1	2.73+ubuntu25.10.1
26.04 LTS (Dev)	< 2.74.1+ubuntu26.04.1	2.74.1+ubuntu26.04.1
Upstream snapd	< 2.75	2.75

Legacy systems (16.04–22.04 LTS): Not vulnerable in default configurations, but Canonical recommends patching as a precaution against non-default setups.

Why This Matters More Than the CVSS Score Suggests

Yes, the attack complexity is "High" because of the 10–30 day waiting period. But consider this:

Shared servers and cloud instances often have uptimes measured in months or years. The cleanup timer will fire.
Multi-user environments (universities, development teams, CI/CD runners) are prime targets — any user on the box can exploit this.
The exploit is deterministic. Unlike race conditions that need microsecond timing, this one just requires patience and a calendar.
No detection signatures exist for the attack in progress — an attacker waiting for cleanup looks identical to a normal user.

Bonus: A Second Bug in uutils Coreutils

While investigating CVE-2026-3888, Qualys also found a race condition in the uutils coreutils package (a Rust rewrite of GNU utilities) shipping with Ubuntu 25.10. The rm utility could be exploited via symlink attacks during root-owned cron executions, leading to arbitrary file deletion as root.

This was caught and fixed before Ubuntu 25.10's public release — the default rm was reverted to GNU coreutils. A reminder that rewriting critical tools in new languages doesn't automatically eliminate all vulnerability classes.

What You Should Do Right Now

1. Patch Immediately

sudo snap refresh snapd

Verify your version:

snap version

2. Audit Temporary Directory Permissions

ls -la /tmp/.snap*

If this directory exists and is owned by a non-root user, investigate immediately.

3. Monitor for Suspicious Activity

Watch for unexpected recreation of /tmp/.snap directories:

inotifywait -m -r /tmp/.snap 2>/dev/null

4. Consider Hardening tmpfiles Configuration

cat /usr/lib/tmpfiles.d/tmp.conf

5. Track This CVE

Stay updated on CVE-2026-3888 and get real-time alerts when new information drops:
Track CVE-2026-3888 on VulnTracker →

The Bigger Picture

CVE-2026-3888 is a textbook example of privilege chaining — where two individually safe components create a dangerous interaction. Neither snap-confine nor systemd-tmpfiles has a bug in isolation. The vulnerability exists in the gap between them.

This pattern is increasingly common in modern Linux distributions, where dozens of privileged services interact through shared filesystem state. As systems grow more complex, these "interaction vulnerabilities" will only become more frequent.

The question isn't whether your system has these gaps. It's whether you'll find them before someone else does.