Description
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | snapd | < 2.75.1 | 2.75.1 |
| Canonical | Ubuntu 16.04 LTS | — | — |
| Canonical | Ubuntu 18.04 LTS | — | — |
| Canonical | Ubuntu 20.04 LTS | — | — |
| Canonical | Ubuntu 22.04 LTS | — | — |
| Canonical | Ubuntu 24.04 LTS | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | snapd | 2.76-1 | — |
| Debian 13 | snapd | 2.68.3-3+deb13u1 | DSA-6170-1 |
| Debian 12 | snapd | 2.57.6-1+deb12u1 | DSA-6170-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | snapd | 2.74.1+ubuntu26.04.3 | — |
| Ubuntu 25.10 | snapd | 2.73+ubuntu25.10.1 | — |
| Ubuntu 24.04 LTS | snapd | 2.73+ubuntu24.04.2 | USN-8102-2 |
| Ubuntu 22.04 LTS | snapd | 2.73+ubuntu22.04.1 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | snapd | 2.67.1+20.04ubuntu1~esm1 | — |
| Ubuntu Pro 18.04 LTS | snapd | 2.61.4ubuntu0.18.04.1+esm2 | — |
| Ubuntu Pro 16.04 LTS | snapd | 2.61.4ubuntu0.16.04.1+esm2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Local Privilege Escalation in snapd
exploit/linux/local/cve_2026_3888
GitHub 8 repositories
-
TheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE ★ 19 · Mar 23, 2026
-
noambouillet/CVE-2026-3888 ★ 5 · Mar 23, 2026
Linux LPE via snap-confine + systemd-tmpfiles, explained in depth
-
netw0rk7/CVE-2026-3888-PoC ★ 3 · Mar 20, 2026
-
fevar54/CVE-2026-3888-POC-all-from-the-Qualys-platform. ★ 2 · Mar 18, 2026
PoC de CVE-2026-3888: condicion de carrera en snapd para escalada a root.
-
AlanNewberry/CVE-2026-3888-snap-confine-privilege-escalation ★ 1 · Oct 6, 2026
Exploit para CVE-2026-3888: race condition en snap-confine con hijack del loader para escalar a root en Linux.
-
alinpfan/CVE-2026-3888-PoC ★ 0 · Oct 12, 2026
CVE-2026-3888 PoC; discovered by the Qualys Threat Research Unit (TRU).
-
hewhomusntbenamed/CVE-2026-3888-fixed ★ 0 · May 12, 2026
CVE-2026-3888 — snap-confine / systemd-tmpfiles SUID LPE (fixed race_pid.txt issue)
-
Many-Hat-Group/Ubuntu-CVE-2026-3888-patcher ★ 0 · Mar 19, 2026
This is a script designed for deployment on ubuntu instances patching the CVE-2026-3888 exploit
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- USN-8102-2 snapd regression Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-6170-1 snapd - security update Debian Security (DSA / DLA) · Mar 19, 2026
- WID-SEC-2026-0758 Canonical Snap: Schwachstelle ermöglicht Erlangen von Administratorrechten BSI CERT-Bund (WID) · Mar 19, 2026
References
- https://ubuntu.com/security/CVE-2026-3888 vdb-entry issue-tracking
- https://ubuntu.com/security/notices/USN-8102-1 vendor-advisory
- https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888 technical-description vendor-advisory
- https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root technical-description media-coverage
- https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt technical-description media-coverage