CVE-2026-3888
HighPublished
Local Privilege Escalation in snapd
- Published
- Mar 17, 2026
- Updated
- Mar 18, 2026
- Assigning CNA
- canonical
- Evidence observed
- Aug 25, 2026
Primary CVSS
7.8/ 10High
Local Privilege Escalation in snapd
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HLow · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
modules/exploits/linux/local/cve_2026_3888.rb
HTB Snapped — Hard Linux machine writeup. CVE-2026-27944 (Nginx UI unauthenticated backup disclosure) chained with CVE-2026-3888 (snapd race condition LPE) to achieve full system compromise.
Linux LPE via snap-confine + systemd-tmpfiles, explained in depth
Local privilege escalation exploit for CVE-2026-3888 targeting snap-confine and systemd-tmpfiles on Ubuntu, providing SUID and capabilities variants to achieve root access.
Proof-of-concept exploit for CVE-2026-3888, a snapd race condition enabling local privilege escalation to root on Ubuntu systems.
Proof-of-concept exploit for CVE-2026-3888, written in C. Demonstrates vulnerability exploitation and binary-level attack techniques for security research and testing.
CVE-2026-3888 — snap-confine / systemd-tmpfiles SUID LPE (fixed race_pid.txt issue)
Proof-of-concept exploit for CVE-2026-3888, including a shared library payload compiled with gcc for vulnerability demonstration.
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.