CVE-2026-3888: LPE to Root in snapd Hits Ubuntu LTS Since 2016

Qualys discovered a local privilege escalation vulnerability in snapd that lets a local attacker gain root on Ubuntu 16.04 through 24.04 LTS. The flaw carries a CVSS 7.8 HIGH rating.

On March 17, 2026, Canonical submitted the CVE-2026-3888 record to NVD, detailing a local privilege escalation in snapd discovered by Qualys. NVD published its initial analysis on June 4, 2026, with CISA-ADP and Canonical updates following on June 17. The vulnerability affects every supported Ubuntu LTS release from 2016 to the present, and its CVSS 7.8 HIGH score underscores the severity for any enterprise running Ubuntu.

Key Takeaways

CVE-2026-3888 is a local privilege escalation in snapd on Linux, discovered by Qualys and documented with a CVSS 7.8 HIGH rating by Canonical Ltd. as CNA
The exploit leverages the recreation of snap's private /tmp directory when systemd-tmpfiles is configured for automatic cleanup, opening an attack window
Affected versions are Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS, spanning nearly a decade of enterprise releases
The vulnerable component is snap-confine, the internal snapd binary that builds the sandboxed execution environment, where a race condition during initialization allows control of the temporary directory before ownership transfers to root

"Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory." — Canonical Ltd. via NVD CVE-2026-3888

The Mechanism: Race Condition in the snap-confine Sandbox

Snap-confine is the program snapd invokes to prepare the execution environment for each snap package. During this bootstrap phase, the binary creates temporary directories and files under /tmp. According to Qualys' analysis cited by The Hacker News, these elements are initially owned by the unprivileged user who launched the application. Ownership transfers to root shortly after, but a window remains where the caller retains full control.

Canonical's official description in the NVD record states that the attacker recreates snap's private /tmp directory when systemd-tmpfiles is configured for automatic cleanup. The Hacker News, reporting on Qualys' analysis, specifies that this configuration opened a race condition: two concurrent race conditions, one based on a malicious FUSE mount and one on a symlink to sensitive system paths. The path /run/udev/ is identified as a target to bypass AppArmor confinement.

The attack vector is local and requires pre-existing unprivileged access to the system, as confirmed by the CVSS PR:L (Privileges Required: Low) field assigned by Canonical. This is not a remote attack: the AV:L (Attack Vector: Local) metric places it in the category of insider threats or post-initial-compromise escalation.

A Recurring Cycle: Hardening Changes Spawn New Flaws

The most significant insight emerges from historical context. Qualys discovered a similar vulnerability in 2022, CVE-2021-44731, also in the snap-confine component. The hardening changes introduced to mitigate that earlier risk have, according to Qualys' reconstruction, generated new race conditions. The problem was not eliminated but transformed.

This pattern is explicitly documented by Saeed Abbasi, head of Qualys' Threat Research Unit, via The Hacker News: "The issue stems from a security hardening change that inadvertently introduced a race condition during sandbox initialization." The phrase "inadvertently introduced" is significant: the fixes worsened the condition in a component considered critical to Ubuntu's security.

The NVD record does not provide details on the 2021-2026 vulnerability cycle, but the convergence of the two Qualys discoveries constitutes an architectural pattern rather than an isolated incident. For organizations with Ubuntu fleets, this implies snap-confine warrants continuous attention regardless of the latest patch applied.

The Impact: Five LTS Releases and the Enterprise Attack Surface

The NVD record explicitly lists five Ubuntu LTS versions as affected: 16.04, 18.04, 20.04, 22.04, and 24.04. This temporal coverage, from 2016 to 2024, touches employee workstations, developer systems, administrative endpoints, and legacy servers still under support. Ubuntu Desktop ships in default configuration on millions of machines; the presence of an LPE to root in this condition exposes a vast attack surface.

The CVSS 3.1 score of 7.8 HIGH with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H warrants dissection. The attack complexity AC:H (High) indicates the exploit is non-trivial, but the scope S:C (Changed) means the impact extends beyond the vulnerable component, affecting resources outside the component's security scope. The combination of confidentiality, integrity, and availability all rated HIGH with changed scope makes the flaw particularly dangerous in multi-tenant environments or those handling sensitive data.

The Hacker News reports a contextual data point not directly tied to CVE-2026-3888: 442 security flaws on Linux published in the last three days at the time of the article. This figure, while not specific to the flaw under examination, positions CVE-2026-3888 in a Linux ecosystem under vulnerability pressure.

Why It Matters

The brief does not specify whether a structured Qualys advisory dedicated to CVE-2026-3888 exists, distinguishing it from CVE-2026-8933, another identifier cited by The Hacker News in the same article. The source details the exploit mechanism for CVE-2026-8933, while the NVD description of CVE-2026-3888 is more generic, limited to the /tmp + systemd-tmpfiles mechanism.

The dossier does not document whether a fix is already available and distributed for all affected LTS versions. No information emerges on in-the-wild exploits or public proof-of-concept code. The exact publication date of The Hacker News article presents an internal inconsistency: the header reads "Jul 22, 2026" while the publication timestamp indicates "Sun, 26 Jul 2026 07:52:07 GMT".

It is unknown whether snap-confine is identified as the exact component in the NVD record for CVE-2026-3888: the official record indicates "snapd" as the vulnerable product, while Qualys' analysis via The Hacker News points specifically to snap-confine. This distinction, though technically fine, is relevant for those mapping critical components of their security posture.

The Lesson of the Sandbox That Doesn't Sandbox

The recurrence of flaws in snap-confine suggests that Ubuntu's isolation model, based on a combination of mount namespaces, AppArmor, and controlled temporary directories, contains a structural blind spot. Every attempt to harden the mechanism has introduced new race conditions. For organizations, this means snapd security cannot be considered definitively solved with a patch, but requires ongoing monitoring of the component over time.

The presence of systemd-tmpfiles as the trigger for automatic cleanup adds an element of interaction between different subsystems: snapd security depends on the configuration of a separate system service. This interdependency is common in Linux, but rarely documented with such clarity as an escalation vector.

The fact that five LTS releases are affected prevents organizations from dismissing the problem as tied to an obsolete or little-used version. Upgrading to 24.04 LTS, the latest version listed, offers no intrinsic protection. Risk assessment must start from the premise that any Ubuntu installation with active snapd is potentially exposed, pending confirmation of specific mitigation from the vendor.

Information is based on cited sources and current as of publication.

Sources

Sources and references