CVE-2026-3888 - snap-confine + systemd-tmpfiles Local Privilege Escalation

Disclaimer: This repository is for educational purposes only. All content is based on the original security advisory published by Qualys on March 17, 2026. The vulnerability has been patched-always ensure your systems are up to date. Do not use this material against systems you do not own or have explicit written permission to test.

Overview

CVE-2026-3888 is a Local Privilege Escalation (LPE) vulnerability affecting the default installation of Ubuntu Desktop >= 24.04. It was discovered and publicly disclosed by Qualys in March 2026.

What makes this vulnerability particularly interesting-as Qualys themselves noted-is that it does not stem from a single buggy component. Instead, it emerges from the interaction of two individually secure programs:

Neither program is broken on its own. Together, they create an exploitable window.

Original advisory: https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt
Credit: Qualys Security Research Team

Repository structure

cve-2026-3888/
├── README.md                        ← You are here
├── analysis/
│   ├── 01-vulnerability.md          ← Deep dive into the vulnerability
│   ├── 02-race-condition.md         ← How the TOCTOU race works
│   ├── 03-backpressure-technique.md ← The AF/UNIX backpressure trick
│   ├── 04-exploitation-steps.md     ← Full step-by-step walkthrough
│   └── 05-mitigations.md            ← What was patched and how
└── src/
    ├── firefox_2404.c               ← Race helper (annotated)
    └── librootshell.c               ← Dynamic loader shellcode (annotated)

Affected versions

Fixed in: snapd 2.74.2

Quick summary of the attack

1. Enter a snap sandbox (e.g. firefox) - snap-confine creates /tmp/.snap as root:root 0755
2. Keep /tmp active with periodic writes, but let /tmp/.snap go stale
3. systemd-tmpfiles deletes the stale /tmp/.snap - since /tmp is world-writable, the attacker recreates .snap and owns it
4. Use the AF/UNIX backpressure technique to single-step snap-confine's execution
5. At the exact moment after step 1 of the mimic sequence, atomically swap the library directory
6. snap-confine bind-mounts attacker-owned libraries as root into the namespace
7. Overwrite ld-linux-x86-64.so.2 with shellcode - any SUID binary executed in this namespace runs our code as root
8. Escape AppArmor confinement via /var/snap/firefox/common/ to get a fully privileged shell

Read more

• 01 - Understanding the Vulnerability
• 02 - The TOCTOU Race Condition
• 03 - The AF/UNIX Backpressure Technique
• 04 - Full Exploitation Walkthrough
• 05 - Mitigations & Patch Analysis