Log in Start free

Vulnerability · Published Mar 17, 2026 · Assigned by canonical

CVE-2026-3888Local Privilege Escalation in snapd

High 7.8

In plain English

A high-severity security flaw in snapd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.4%top 27.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Metasploit, Public PoC

Official description

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12snapd2.57.6-1+deb12u1DSA-6170-1
Debian:12snapd2.57.6-1+deb12u1DEBIAN-CVE-2026-3888
Debian:13snapd2.68.3-3+deb13u1DSA-6170-1
Debian:13snapd2.68.3-3+deb13u1DEBIAN-CVE-2026-3888
Debian:14snapd2.76-1DEBIAN-CVE-2026-3888
Ubuntu:22.04:LTSsnapd2.73+ubuntu22.04.1UBUNTU-CVE-2026-3888
Ubuntu:24.04:LTSsnapd2.73+ubuntu24.04.2USN-8102-2
Ubuntu:24.04:LTSsnapd2.73+ubuntu24.04.2UBUNTU-CVE-2026-3888
Ubuntu:25.10snapd2.73+ubuntu25.10.1UBUNTU-CVE-2026-3888
Ubuntu:26.04:LTSsnapd2.74.1+ubuntu26.04.3UBUNTU-CVE-2026-3888

Affected products (as reported)

VendorProductVersions
snapd 0 – before 2.75.1
Canonical Ubuntu 16.04 LTS see references
Canonical Ubuntu 18.04 LTS see references
Canonical Ubuntu 20.04 LTS see references
Canonical Ubuntu 22.04 LTS see references
Canonical Ubuntu 24.04 LTS see references

Weakness: CWE-268 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References