Qualys discovered a vulnerability in snapd which allows local attackers to escalate privileges. We assigned CVE-2026-3888 for it. This vulnerability impacts default installations of Ubuntu 24.04 LTS and Ubuntu 25.10, but we also applied the same hardening to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS as non-default configurations could be vulnerable to it. The hardening will also be applied to upstream snapd version 2.75.1.
Affected releases
| Release | Package Name | Fixed Version |
|---|---|---|
| Xenial (16.04) | snapd | 2.61.4ubuntu0.16.04.1+esm2 |
| Bionic (18.04) | snapd | 2.61.4ubuntu0.18.04.1+esm2 |
| Focal (20.04) | snapd | 2.67.1+20.04ubuntu1~esm1 |
| Jammy (22.04) | snapd | 2.73+ubuntu22.04.1 |
| Noble (24.04) | snapd | 2.73+ubuntu24.04.2 |
| Questing (25.10) | snapd | 2.73+ubuntu25.10.1 |
How to check if you are impacted
On your system, run the following command and compare the listed version to the table above.
dpkg -l snapd
How to address
We recommend you upgrade all packages:
sudo apt update && sudo apt upgrade
If this is not possible, the affected component can be targeted:
sudo apt update && sudo apt install --only-upgrade snapd
The unattended-upgrades feature is enabled by default for Ubuntu 16.04 LTS onwards. This service:
- Applies new security updates every 24 hours automatically.
- If you have this enabled, the patches above will be automatically applied within 24 hours of being available.
Mitigation
The fix for this vulnerability is a configuration change that could also be applied manually, but as a reminder, the strongest protection is to apply the security updates. If security updates cannot be applied, you should only apply the following steps as a last resort. Please note that modifying configuration files may stop future unattended upgrades from completing successfully, until these are reverted to the original content.
To manually apply the fix.
Replace the entire contents of /usr/lib/tmpfiles.d/snapd.conf with the following:
D! /tmp/snap-private-tmp 0700 root root -
# Allow removing content in the private tmp folders without affecting the
# architectural structure of the folders themselves.
X /tmp/snap-private-tmp
X /tmp/snap-private-tmp/*/tmp
x /tmp/snap-private-tmp/*/tmp/.snap
After it, run:
sudo systemctl restart systemd-tmpfiles-clean.service
How the exploits work
Qualys discovered that this unusual Local Privilege Escalation (LPE) stems from the interaction of two otherwise secure programs:
- snap-confine: used internally by snapd to construct the execution environment for snap applications.
- systemd-tmpfiles: used to create, delete and clean up files and directories in /tmp.
To use this LPE to obtain a fully privileged root shell, an unprivileged local attacker must wait for systemd-tmpfiles to delete the /tmp/snap-private-tmp//tmp/.snap directory for any already installed snap. This occurs 10 days after the last access or modification in Ubuntu 25.10, or 30 days in Ubuntu 24.04.
Acknowledgements
We would like to thank Qualys for their excellent reporting.