CVE-2026-3888

VendorcanonicalProductubuntu linuxDiscoveredMar 17, 2026UpdatedJun 4, 2026

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

View graph Watch Export

CVSS v3.1

7.8 HIGH

EPSS

1.41%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Nov 4, 2026

▲ 1.03pp

0.38% → 1.41% over 5 tracked changes

CVSS v3.1 Detail

Attack VectorLOCAL

Attack ComplexityHIGH

Privileges RequiredLOW

User InteractionNONE

ScopeCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Connections

5 relationships

ubuntu linux

source

Timeline

disclosure → media coverage

Mar 17, 2026

Disclosure — published as a CVE record. · last revised by NVD Jun 4, 2026

Mar 18, 2026

thehackernews.com reports: Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit

Mar 18, 2026

infosecurity-magazine.com reports: New Ubuntu Flaw Enables Local Attackers to Gain Root Access

Mar 19, 2026

itmedia.co.jp reports: Ubuntuに深刻な権限昇格問題　root取得の恐れ

Public PoC (9)

github.com/fevar54/CVE-2026-3888-POC-all-from-the-Qualys-platform.github.com/Many-Hat-Group/Ubuntu-CVE-2026-3888-patcher github.com/netw0rk7/CVE-2026-3888-PoC github.com/TheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE github.com/noambouillet/CVE-2026-3888 github.com/DanielTangnes/CVE-2026-3888 github.com/hewhomusntbenamed/CVE-2026-3888-fixed github.com/AlanNewberry/CVE-2026-3888-snap-confine-privilege-escalation github.com/alinpfan/CVE-2026-3888-PoC

Unverified third-party code — review before executing.