CVE-2026-3888: Ubuntu snapd Local Privilege Escalation via systemd-tmpfiles Timing Race

CVE-2026-3888 is a local privilege escalation (LPE) vulnerability affecting the snapd daemon on Ubuntu Linux. The flaw was discovered by researchers at Qualys and stems from improper handling of snap's private /tmp directory when systemd-tmpfiles is configured to periodically clean it up.

When systemd-tmpfiles removes the private /tmp directory as part of its automatic cleanup routine, a race condition is introduced. A local attacker — already present on the system with limited privileges — can exploit this window to re-create the deleted directory with attacker-controlled permissions or symlinks, potentially allowing code execution with root-level privileges.

This type of attack, sometimes called a TOCTOU (time-of-check to time-of-use) or cleanup-timing exploit, is particularly dangerous because it does not require special privileges to trigger — only a standard local account. The Changed scope in the CVSS rating reflects that a successful exploit can break out of the snap confinement boundary and affect the broader host system.

The vulnerability receives a CVSS 3.1 base score of 7.8 (High), with High impact across confidentiality, integrity, and availability. Ubuntu has rated this as High priority.

All currently supported Ubuntu LTS releases are affected, including 20.04 (Focal), 22.04 (Jammy), and 24.04 (Noble), as well as the development release 25.10 (Questing). Older ESM-supported releases 16.04 (Xenial) and 18.04 (Bionic) are also impacted and have received patches under Ubuntu's Extended Security Maintenance programme.

Patches have been released across all affected releases. System administrators should update snapd immediately using their package manager.