Qualys Discloses Ubuntu Snapd Flaw Allowing Root Escalation

Qualys researchers have disclosed a high-severity vulnerability in Ubuntu's Snap daemon that allows local attackers to gain root privileges on affected systems. Tracked as CVE-2026-3888, the local privilege escalation flaw impacts default installations of Ubuntu Desktop 24.04 and later versions, with patches now available to address the issue.

The vulnerability arises from an interaction between snapconfine, a component that sets up secure sandboxes for Snap applications, and systemdtmpfiles, a systemd utility that automatically cleans temporary directories. In default configurations, systemdtmpfiles deletes stale files in directories like /tmp after a set period, typically 10 to 30 days depending on the Ubuntu version. An unprivileged local attacker can exploit this by waiting for the cleanup process to remove a critical directory, such as /tmp/snap, then recreating it with malicious content. When snapconfine next initializes a sandbox, it bind-mounts the altered files with root privileges, enabling arbitrary code execution and full system compromise.

Qualys Threat Research Unit described the exploit as relying on a timing-based chain that requires patience but no user...