CVE-2026-3888 Local Privilege Escalation in snapd
Local attackers can gain root privileges by exploiting snapd's private /tmp directory handling when systemd-tmpfiles cleanup is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3888?
CVE-2026-3888 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 17 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
Weakness: CWE-268
Which versions are affected by CVE-2026-3888?
It affects 1 product.
Products include Canonical Ubuntu Linux.
How do I fix CVE-2026-3888?
Apply the vendor's patch.
Is CVE-2026-3888 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3888 exists.
Public exploit code: 1 Metasploit module and 9 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2026-3888, DSA-6170-1, GHSA-grpw-jgrw-ccqr, UBUNTU-CVE-2026-3888, USN-8102-2.