A critical security vulnerability, codenamed CVE-2026-3888, affects default installations of Ubuntu Desktop versions 24.04 and later, allowing attackers to gain full root access to the system.
The vulnerability, with a CVSS score of 7.8, results from the interaction of two key system components: snap-confine and systemd-tmpfiles. This discovery is a significant blow to the security of Linux systems, as it affects millions of users worldwide who rely on the stability and security of Ubuntu.
See also: Vulnerability in Ubuntu Kernel allows Root access
According to the Qualys Threat Research Unit (TRU), CVE-2026-3888 allows an unprivileged local attacker to escalate their privileges to full root access. The issue arises from the interaction between snap-confine, which manages execution environments for snap by creating a sandbox, and systemd-tmpfiles, which automatically cleans up temporary files and directories older than a specified threshold. This interaction, which normally works smoothly to maintain system cleanliness, can be maliciously exploited to bypass security mechanisms.
The vulnerability has been fixed in the following releases:
- Ubuntu 24.04 LTS – snapd versions prior to 2.73+ubuntu24.04.1
- Ubuntu 25.10 LTS – snapd versions prior to 2.73+ubuntu25.10.1
- Ubuntu 26.04 LTS (Dev) – snapd versions prior to 2.74.1+ubuntu26.04.1
- Upstream snapd – versions prior to 2.75
The attack can be done with low privileges and without any user interaction . However, the complexity of the attack is high due to the time delay mechanism in the exploit chain . The attacker must wait for the system cleanup daemon to delete a critical directory ( /tmp/.snap ) required by snap-confine . The default period is 30 days in Ubuntu 24.04 and 10 days in later versions. This time window, although large, is not a significant obstacle for a determined attacker who has already gained local access to a system.
See also: Critical vulnerability in Telnetd allows Root RCE via Port 23
Once deleted, the attacker recreates the directory with malicious payloads.
During the next sandbox initialization, the snap-confine bind mounts these files as root, allowing arbitrary code execution within the privileged context.
Ubuntu Desktop: Security Impact and Fixes
The vulnerability , CVE-2026-3888, affects millions of Ubuntu Desktop, as it affects the default settings of versions 24.04 LTS and later. Although no public exploit has been reported, the nature of the vulnerability and the widespread use of Ubuntu make it critical to update immediately. The impact is particularly significant for enterprise environments and critical infrastructures that rely on Ubuntu for their daily operations, as a successful exploit could lead to a complete compromise of systems.
See also: Jupyter vulnerability allows escalation of root privileges
The discovery of CVE-2026-3888 is a reminder of the criticality of ongoing cybersecurity vigilance and the importance of promptly applying security patches. Organizations using Ubuntu systems should develop comprehensive vulnerability management strategies that include regular security assessments, automated patching processes, and incident response plans.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
