Ubuntu Desktop Systems Vulnerability Enables Attackers to Gain Full Root Access
A Local Privilege Escalation (LPE) vulnerability has been identified in default installations of Ubuntu Desktop 24.04 and later. This vulnerability allows an unprivileged local attacker to gain full root access.
A Local Privilege Escalation (LPE) vulnerability has been identified in default installations of Ubuntu Desktop 24.04 and later. This vulnerability allows an unprivileged local attacker to gain full root access.
Designated as CVE-2026-3888, and discovered by the Qualys Threat Research Unit, the vulnerability exploits an interaction between two system components: snap-confine and systemd-tmpfiles. These components are integral to default Ubuntu deployments.
Snapd is the background service in Ubuntu responsible for managing snap packages, which are self-contained application bundles with dependencies. It also enforces a permission model that governs application access, functioning as both a package manager and a security policy engine.
snap-confine : A setuid root binary that builds snap sandboxes before application execution, managing mount namespace isolation, cgroup enforcement, AppArmor policy loading, and seccomp filtering. systemd-tmpfiles : Manages volatile directories like /tmp , /run , and /var/tmp . It creates these directories at boot and purges stale files based on a timer.
CVE-2026-3888 has a CVSS v3.1 score of 7.8 (High), indicating significant impact on confidentiality, integrity, and availability. The exploitation process involves:
Waiting for the cleanup daemon to delete /tmp/.snap , a directory used during sandbox initialization. Recreating /tmp/.snap with malicious payloads. On the next initialization, snap-confine bind-mounts these files as root, enabling arbitrary code execution within a privileged context.
A Local Privilege Escalation (LPE) vulnerability has been identified in default installations of Ubuntu Desktop 24.04 and later.
Organizations are advised to update snapd to the following patched versions:
Ubuntu Version Vulnerable snapd Patched Version
Ubuntu 24.04 LTS Prior to 2.73+ubuntu24.04.1 2.73+ubuntu24.04.1
Ubuntu 25.10 Prior to 2.73+ubuntu25.10.1 2.73+ubuntu25.10.1
Ubuntu 26.04 LTS (Dev) Prior to 2.74.1+ubuntu26.04.1 2.74.1+ubuntu26.04.1
Upstream snapd Prior to 2.75 2.75
Legacy systems running Ubuntu 16.04–22.04 LTS are not vulnerable under default configurations. However, applying the patch is recommended as a precaution.
During a security review before the Ubuntu 25.10 release, a race condition was identified in the uutils coreutils package. This flaw in the rm utility allowed directory entries to be replaced with symlinks during root-owned cron executions, potentially leading to file deletion or privilege escalation.
The Ubuntu Security Team mitigated this risk by reverting the default rm command in Ubuntu 25.10 to GNU coreutils, with upstream fixes applied to the uutils repository.
Based on reporting by Cyber Security News.