CVE-2026-3888: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-3888 is a local privilege escalation (LPE) vulnerability in snapd on Ubuntu Linux that allows a low-privileged local attacker to gain full root access by re-creating snap's private /tmp directory after it is automatically cleaned up by systemd-tmpfiles. Discovered and disclosed by the Qualys Threat Research Unit on March 17, 2026, it affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS in their default desktop configurations. The vulnerability has a CVSS v3.1 base score of 7.8 (High) (Ubuntu Security, Qualys Blog).

The vulnerability (CWE-268: Privilege Chaining) stems from an unintended interaction between two privileged system components: snap-confine (a setuid-root or capability-enabled binary that constructs snap application sandboxes) and systemd-tmpfiles (which automatically cleans up stale files in /tmp after 30 days on Ubuntu 24.04, or 10 days on later versions). When systemd-tmpfiles deletes the /tmp/.snap directory used by snap-confine for "mimic" bind-mount operations, an unprivileged attacker can recreate that directory with malicious content. On the next sandbox initialization, snap-confine — running as root — bind-mounts the attacker-controlled files into privileged locations (e.g., /usr/lib/x86_64-linux-gnu), enabling arbitrary code execution as root by exploiting a race condition between bind-mount steps. The full technical advisory and proof-of-concept exploit chain are documented by Qualys (Qualys Advisory, oss-security).

Successful exploitation grants a local unprivileged user complete root access on the affected Ubuntu system, resulting in full compromise of confidentiality, integrity, and availability. An attacker can read sensitive files (e.g., /etc/shadow), install persistent backdoors, escalate to other systems via credential theft, or disrupt system operations. The scope is changed — the exploit breaks out of the snap sandbox confinement boundary to affect the host system (Qualys Blog, Ubuntu Security).

A public proof-of-concept exploit written in Python is available on GitHub (fevar54/CVE-2026-3888-POC-all-from-the-Qualys-platform), and additional PoC implementations have been published (e.g., jesusgavancho/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE). Exploitation has been demonstrated in HackTheBox's "Snapped" machine and documented in multiple writeups (HTB Blog, 0xdf Writeup). The EPSS score is approximately 0.006%, reflecting low automated exploitation probability, but the availability of working PoC code and the broad attack surface (all default Ubuntu Desktop ≥ 24.04 installations) make it a meaningful risk. No CISA KEV listing or specific threat actor attribution has been reported. Detection rules have been added to Elastic's detection-rules repository (Feedly).

1. Gain local access: Obtain a low-privileged shell on a vulnerable Ubuntu Desktop system (16.04–24.04+ LTS with snapd installed and systemd-tmpfiles configured for /tmp cleanup).
2. Enter snap sandbox: Execute snap-confine with a default snap (e.g., Firefox) to obtain an unprivileged shell inside the snap's sandbox: env -i SNAP_INSTANCE_NAME=firefox /usr/lib/snapd/snap-confine --base core22 snap.firefox.hook.configure /bin/bash.
3. Keep /tmp alive, let /tmp/.snap age: From inside the sandbox, cd /tmp and repeatedly touch ./ (but not ./.snap) to keep /tmp fresh while allowing /tmp/.snap to go unaccessed. Wait 30 days (Ubuntu 24.04) or 10 days (Ubuntu >24.04) for systemd-tmpfiles to delete /tmp/.snap.
4. Recreate /tmp/.snap with malicious content: From outside the sandbox (via /proc/<pid>/cwd), recreate ./.snap and populate ./.snap/usr/lib/x86_64-linux-gnu.exchange with a malicious dynamic loader (ld-linux-x86-64.so.2) containing shellcode that calls setreuid(0) and execve(/tmp/sh).
5. Destroy and reinitialize the sandbox: Destroy the existing sandbox using an invalid base (--base snapd), then re-invoke snap-confine with --base core22 while monitoring its debug output (SNAPD_DEBUG=1) byte-by-byte via an AF_UNIX socket to single-step execution.
6. Win the race condition: Immediately after snap-confine bind-mounts /usr/lib/x86_64-linux-gnu onto /tmp/.snap/usr/lib/x86_64-linux-gnu (step 1 of mimic creation), swap ./.snap/usr/lib/x86_64-linux-gnu with the attacker-controlled .exchange directory.
7. Obtain root inside sandbox: Re-enter the sandbox and execute a SUID-root binary (e.g., snap-confine itself), which loads the attacker's malicious dynamic loader and spawns a root shell.
8. Escape sandbox to full root: Copy /bin/bash to /var/snap/firefox/common/bash, chmod 04755 it (permitted by AppArmor), exit the sandbox, and execute /var/snap/firefox/common/bash -p to obtain a fully privileged root shell on the host (Qualys Advisory).

• Process: Unusual invocations of /usr/lib/snapd/snap-confine with --base snapd or invalid base arguments from non-root users; snap-confine spawning shells (/bin/bash, busybox) as root; SUID-root binaries executed from /tmp/.snap/ paths.
• File System: Unexpected directories or files in /tmp/.snap/ owned by non-root users; presence of ld-linux-x86-64.so.2 or shared libraries in /tmp/.snap/usr/lib/ not owned by root; SUID-root bash copies in /var/snap/<snapname>/common/ (e.g., /var/snap/firefox/common/bash with mode 04755); librootshell.so or similar files in /tmp/.
• Logs: systemd-tmpfiles log entries showing deletion of /tmp/.snap; AppArmor denials or unusual snap-confine mount operations in /var/log/syslog or journalctl; SNAPD_DEBUG=1 environment variable set in snap-confine process environment.
• Network: Outbound connections from processes running as root originating from snap sandbox PIDs (visible via /proc/<pid>/net).
• Detection Rules: Elastic detection rules have been published for this vulnerability (Elastic Rules).

Canonical has released patched snapd versions for all affected Ubuntu releases: 24.04 LTS → 2.73+ubuntu24.04.2; 22.04 LTS → 2.73+ubuntu22.04.1; 20.04 LTS → 2.67.1+20.04ubuntu1~esm1 (Ubuntu Pro); 18.04 LTS → 2.61.4ubuntu0.18.04.1+esm2 (Ubuntu Pro); 16.04 LTS → 2.61.4ubuntu0.16.04.1+esm2 (Ubuntu Pro); 25.10 → 2.73+ubuntu25.10.1; 26.04 → 2.74.1+ubuntu26.04.3. Upgrade snapd immediately via sudo apt update && sudo apt upgrade snapd. As a workaround, review and adjust /usr/lib/tmpfiles.d/tmp.conf to disable automatic cleanup of /tmp (remove or comment out the D /tmp or q /tmp line), though this may have operational side effects. Restricting local user access and monitoring for unusual snap-confine activity are additional defensive measures (Ubuntu Security, Qualys Blog).

The vulnerability received significant coverage across security media and community forums. Qualys's Threat Research Unit published a detailed blog post and full technical advisory, describing the exploit as particularly novel due to its mandatory 10–30 day waiting period before exploitation is possible (Qualys Blog). Security researcher Michael Orlitzky commented on oss-security that the vulnerability is a consequence of POSIX-noncompliant use of /tmp by snap-confine, noting that systemd itself documents how to avoid this class of issue (oss-security). The vulnerability was featured in HackTheBox's "Snapped" machine, generating extensive community writeups and discussion (HTB Blog). Coverage appeared in Infosecurity Magazine, SecurityAffairs, Phoronix, Heise, and multiple Reddit communities, with the Hacker News thread generating notable discussion about the unusual time-delayed exploitation mechanism.