Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-3888

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:47a2dab71f907741545d2009ab72e1e8b0e7a6af0fba021f8a4e776343473d23
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 6 assertions

{"collectionURL":"https://launchpad.net/ubuntu/bionic","defaultStatus":"affected","packageName":"snapd","platforms":["Linux"],"product":"Ubuntu 18.04 LTS","repo":"https://launchpad.net/ubuntu/+source/snapd","vendor":"Canonical","versions":[{"lessThan":"*","status":"unaffected","version":"2.61.4ubuntu0.18.04.1+esm2","versionType":"dpkg"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/affected/2

{"collectionURL":"https://launchpad.net/ubuntu/jammy","defaultStatus":"affected","packageName":"snapd","platforms":["Linux"],"product":"Ubuntu 22.04 LTS","repo":"https://launchpad.net/ubuntu/+source/snapd","vendor":"Canonical","versions":[{"lessThan":"*","status":"unaffected","version":"2.73+ubuntu22.04.1","versionType":"dpkg"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/affected/4

{"collectionURL":"https://launchpad.net/ubuntu/xenial","defaultStatus":"affected","packageName":"snapd","platforms":["Linux"],"product":"Ubuntu 16.04 LTS","repo":"https://launchpad.net/ubuntu/+source/snapd","vendor":"Canonical","versions":[{"lessThan":"*","status":"unaffected","version":"2.61.4ubuntu0.16.04.1+esm2","versionType":"dpkg"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/affected/1

{"collectionURL":"https://github.com/canonical","defaultStatus":"unaffected","packageName":"snapd","repo":"https://github.com/canonical/snapd/","versions":[{"lessThan":"2.75.1","status":"affected","version":"0","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/affected/0

{"collectionURL":"https://launchpad.net/ubuntu/noble","defaultStatus":"affected","packageName":"snapd","platforms":["Linux"],"product":"Ubuntu 24.04 LTS","repo":"https://launchpad.net/ubuntu/+source/snapd","vendor":"Canonical","versions":[{"lessThan":"*","status":"unaffected","version":"2.73+ubuntu24.04.2","versionType":"dpkg"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/affected/5

{"collectionURL":"https://launchpad.net/ubuntu/focal","defaultStatus":"affected","packageName":"snapd","platforms":["Linux"],"product":"Ubuntu 20.04 LTS","repo":"https://launchpad.net/ubuntu/+source/snapd","vendor":"Canonical","versions":[{"lessThan":"*","status":"unaffected","version":"2.67.1+20.04ubuntu1~esm1","versionType":"dpkg"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/affected/3

Affected products and versions

6 source assertions
{"collectionURL":"https://launchpad.net/ubuntu/bionic","defaultStatus":"affected","packageName":"snapd","platforms":["Linux"],"product":"Ubuntu 18.04 LTS","repo":"https://launchpad.net/ubuntu/+source/snapd","vendor":"Canonical","versions":[{"lessThan":"*","status":"unaffected","version":"2.61.4ubuntu0.18.04.1+esm2","versionType":"dpkg"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/affected/2
{"collectionURL":"https://launchpad.net/ubuntu/jammy","defaultStatus":"affected","packageName":"snapd","platforms":["Linux"],"product":"Ubuntu 22.04 LTS","repo":"https://launchpad.net/ubuntu/+source/snapd","vendor":"Canonical","versions":[{"lessThan":"*","status":"unaffected","version":"2.73+ubuntu22.04.1","versionType":"dpkg"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/affected/4
{"collectionURL":"https://launchpad.net/ubuntu/xenial","defaultStatus":"affected","packageName":"snapd","platforms":["Linux"],"product":"Ubuntu 16.04 LTS","repo":"https://launchpad.net/ubuntu/+source/snapd","vendor":"Canonical","versions":[{"lessThan":"*","status":"unaffected","version":"2.61.4ubuntu0.16.04.1+esm2","versionType":"dpkg"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/affected/1
{"collectionURL":"https://github.com/canonical","defaultStatus":"unaffected","packageName":"snapd","repo":"https://github.com/canonical/snapd/","versions":[{"lessThan":"2.75.1","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/affected/0
{"collectionURL":"https://launchpad.net/ubuntu/noble","defaultStatus":"affected","packageName":"snapd","platforms":["Linux"],"product":"Ubuntu 24.04 LTS","repo":"https://launchpad.net/ubuntu/+source/snapd","vendor":"Canonical","versions":[{"lessThan":"*","status":"unaffected","version":"2.73+ubuntu24.04.2","versionType":"dpkg"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/affected/5
{"collectionURL":"https://launchpad.net/ubuntu/focal","defaultStatus":"affected","packageName":"snapd","platforms":["Linux"],"product":"Ubuntu 20.04 LTS","repo":"https://launchpad.net/ubuntu/+source/snapd","vendor":"Canonical","versions":[{"lessThan":"*","status":"unaffected","version":"2.67.1+20.04ubuntu1~esm1","versionType":"dpkg"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/affected/3

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-268","description":"CWE-268 Privilege chaining","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/problemTypes/0/descriptions/0

Source references

6 source assertions
{"url":"http://www.openwall.com/lists/oss-security/2026/03/18/1"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/adp/1/references/0
{"tags":["technical-description","media-coverage"],"url":"https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/references/3
{"tags":["technical-description","media-coverage"],"url":"https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/references/4
{"tags":["technical-description","vendor-advisory"],"url":"https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/references/2
{"tags":["vdb-entry","issue-tracking"],"url":"https://ubuntu.com/security/CVE-2026-3888"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/references/0
{"tags":["vendor-advisory"],"url":"https://ubuntu.com/security/notices/USN-8102-1"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:e6f39e977929779c775ed31fef73738c9df21078dd00b050d7b38d79b2eef02a · sha256:4b01beccb85a1035… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer