Summary
Qualys discovered that snapd incorrectly handled certain operations in the
snap's private /tmp directory. If systemd-tmpfiles is enabled to automatically
clean up this directory, a local attacker could possibly use this issue to
re-create the deleted directory, resulting in privilege escalation.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | snapd | 2.73+ubuntu22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | snapd | 2.73+ubuntu24.04.1 |
| Ubuntu · 25.10 | snapd | 2.73+ubuntu25.10.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | snapd | 2.61.4ubuntu0.16.04.1+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | snapd | 2.61.4ubuntu0.18.04.1+esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | snapd | 2.67.1+20.04ubuntu1~esm1 |
References
-
report
https://ubuntu.com/security/CVE-2026-3888