CVE-2026-3888: canonical ubuntu_linux Privilege Chaining
Vulnerability summary
CVE-2026-3888 is a high (CVSS 7.8) Privilege Chaining vulnerability in canonical ubuntu_linux. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 17-03-2026PublishedVulnerability first disclosed.
- 18-03-2026Last modifiedVulnerability information updated.
Description
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
+0.09 pp
From 0.38% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundLocal Privilege Escalation in snapd
exploit/linux/local/cve_2026_3888
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 20.04 | 22.04 | 24.04
Debian1 product
- snapd< 2.76-1 | < 2.57.6-1+deb12u1 | < 2.68.3-3+deb13u1
Ubuntu1 product
- snapd< 2.61.4ubuntu0.16.04.1+esm2 | < 2.61.4ubuntu0.18.04.1+esm2 | < 2.67.1+20.04ubuntu1~esm1 | < 2.73+ubuntu22.04.1 | < 2.73+ubuntu25.10.1 | < 2.74.1+ubuntu26.04.3 | < 2.73+ubuntu24.04.2
3 vendors · 3 products
References
10 links- discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888Technical DescriptionVendor AdvisoryMitigationThird Party Advisory
- blog.qualys.com/vulnerabilities-threat-research/…Technical DescriptionMedia CoverageREPORTMitigationThird Party Advisory
- cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txtTechnical DescriptionMedia CoverageThird Party Advisory
