Skip to content
OpenAdvisories
Unscored USN-8102-1 0 CVEs

snapd vulnerability

Published Mar 17, 2026 · Updated Jun 25, 2026

Summary

Qualys discovered that snapd incorrectly handled certain operations in the
snap's private /tmp directory. If systemd-tmpfiles is enabled to automatically
clean up this directory, a local attacker could possibly use this issue to
re-create the deleted directory, resulting in privilege escalation.

Fixed packages 6

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS snapd 2.73+ubuntu22.04.1
Ubuntu · 24.04 LTS 24.04:LTS snapd 2.73+ubuntu24.04.1
Ubuntu · 25.10 snapd 2.73+ubuntu25.10.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS snapd 2.61.4ubuntu0.16.04.1+esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS snapd 2.61.4ubuntu0.18.04.1+esm2
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS snapd 2.67.1+20.04ubuntu1~esm1

References

  • report
    https://ubuntu.com/security/CVE-2026-3888