Ubuntu's Snap Affected By Local Privilege Escalation Vulnerability
([Ubuntu] 2 Hours Ago
Ubuntu Snapd)
- Reference: 0001620548
- News link: https://www.phoronix.com/news/Ubuntu-Snapd-High-Vulnerability
- Source link:
Last week it was [1]security issues with AppArmor to worry about on Ubuntu Linux while this week a "high" rated vulnerability for Ubuntu's Snap daemon has been revealed.
CVE-2026-3888 was made public yesterday as a local privilege escalation affecting Snapd on ubuntu. Those with local user access can obtain root privileges by recreating Snap's private /tmp directory when systemd-tmpfiles is enabled. The [2]CVE report notes:
"Qualys discovered that snapd incorrectly handled certain operations in the snap’s private /tmp directory. If systemd-tmpfiles is enabled to automatically clean up this directory, a local attacker could possibly use this issue to re-create the deleted directory, resulting in privilege escalation."
The CVSS3 severity score puts it into the 7.8 "high" category.
The [3]announcement of this local privilege escalation has led to updates being applied to Ubuntu 25.10 and all Ubuntu LTS releases back to Ubuntu 16.04 LTS. Ubuntu 24.04 LTS and Ubuntu 25.10 are affected out-of-the-box with the default settings while Ubuntu 22.04 LTS and older are only affected in non-default configurations.
[1] https://www.phoronix.com/news/Ubuntu-AppArmor-Security-Issues
[2] https://ubuntu.com/security/CVE-2026-3888
[3] https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888/78627
CVE-2026-3888 was made public yesterday as a local privilege escalation affecting Snapd on ubuntu. Those with local user access can obtain root privileges by recreating Snap's private /tmp directory when systemd-tmpfiles is enabled. The [2]CVE report notes:
"Qualys discovered that snapd incorrectly handled certain operations in the snap’s private /tmp directory. If systemd-tmpfiles is enabled to automatically clean up this directory, a local attacker could possibly use this issue to re-create the deleted directory, resulting in privilege escalation."
The CVSS3 severity score puts it into the 7.8 "high" category.
The [3]announcement of this local privilege escalation has led to updates being applied to Ubuntu 25.10 and all Ubuntu LTS releases back to Ubuntu 16.04 LTS. Ubuntu 24.04 LTS and Ubuntu 25.10 are affected out-of-the-box with the default settings while Ubuntu 22.04 LTS and older are only affected in non-default configurations.
[1] https://www.phoronix.com/news/Ubuntu-AppArmor-Security-Issues
[2] https://ubuntu.com/security/CVE-2026-3888
[3] https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888/78627