CVE-2026-3888: Ubuntu Default Installation Flaw Lets Unprivileged Attackers Escalate to Root via systemd Cleanup Timing

CVE-2026-3888 is a privilege chaining vulnerability — it exploits the interaction between two trusted, deeply privileged system components rather than a bug in a single binary. Snap-confine is the setuid root binary that builds and enforces the sandboxed execution environment for every snap application on Ubuntu. It handles mount namespace isolation, cgroup enforcement, and AppArmor policy loading. Because it runs as root to build these sandboxes, it is a high-value target — anything that can manipulate what snap-confine mounts or executes gains root-level code execution. systemd-tmpfiles is the service that manages volatile directories including /tmp. On Ubuntu 24.04, it is configured to automatically delete stale data from /tmp after 30 days of system uptime. On later Ubuntu versions, this window is 10 days. One of the directories snap-confine requires to function correctly is /tmp/.snap. When systemd-tmpfiles deletes that directory after its configured cleanup window, snap-confine's expected environment no longer exists. The attack exploits exactly this gap. An attacker with a low-privilege user account waits for the systemd-tmpfiles cleanup cycle to delete /tmp/.snap — 10 to 30 days of uptime depending on the Ubuntu version. Once the directory is deleted, the attacker immediately recreates it and populates it with malicious payloads under their control. On the next occasion that a snap application sandbox is initialised, snap-confine — running as root — blindly bind-mounts the attacker-controlled contents of that directory into the privileged execution context, granting the attacker arbitrary code execution as root.

The attack requires only a local user account with standard low privileges — no administrator access, no sudo rights, and no user interaction from any other person on the system. The CVSS vector AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H reflects this: local access only, but high impact across confidentiality, integrity, and availability with a changed scope — meaning a successful exploit impacts resources beyond the vulnerable component itself. The Attack Complexity is rated High due to the time-delay mechanism — the attacker must wait for the cleanup cycle — but this is not a meaningful barrier in practice for a determined attacker with persistent local access. In multi-user environments, shared servers, developer workstations, university systems, or any Ubuntu Desktop deployment where multiple users have shell access, any one of those low-privilege users can exploit this flaw to become root on the entire system. The scope of affected systems is broad because snapd is installed and enabled in every default Ubuntu Desktop installation since Ubuntu 16.04 — this is not an optional or obscure component. Beyond CVE-2026-3888, Qualys also discovered a separate race condition in the uutils coreutils package — the Rust rewrite of standard GNU utilities — that allowed an unprivileged user to replace directory entries with symlinks during root-owned cron executions targeting /etc/cron.daily/apport. This was mitigated before the Ubuntu 25.10 release by reverting the default rm command to GNU coreutils.