Back Cybersecuritynews

Ubuntu Desktop Systems Vulnerability Enables Attackers to Gain Full Root Access

Cybersecuritynews •Guru Baran • March 18, 2026

A Local Privilege Escalation (LPE) vulnerability in default installations of Ubuntu Desktop 24.04 and later allows an unprivileged local attacker to gain full root access. Tracked as CVE-2026-3888, uncovered by The Qualys Threat Research Unit, the flaw exploits an unintended interaction between two standard system components, snap-confine and systemd-tmpfiles, making it particularly dangerous given how […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Ubuntu Snap Flaw Allows Local Privilege Escalation A local privilege escalation vulnerability, tracked as CVE-2026-3888, has been identified in default installations of Ubuntu Desktop 24.04 and later. Discovered by Qualys, the flaw arises from an unintended interaction between snap-confine and systemd-tmpfiles, allowing unprivileged local users to gain full root access. The attack requires a specific timing window of 10 to 30 days for the system to delete a critical directory in /tmp, after which an attacker can recreate it with malicious content. This vulnerability has a high severity rating with a CVSS score of 7.8. Affected versions include snapd prior to 2.73+ubuntu24.04.1 for Ubuntu 24.04 LTS and earlier versions for subsequent releases. Organizations are urged to apply patches immediately to mitigate risks. Legacy Ubuntu versions are not vulnerable under default configurations but should still be updated as a precaution. 11 sources 74

Extracted Entities

Ubuntu Desktop Systems Vulnerability Enables Attackers to Gain Full Root Access

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)