Qualys Threat Research Unit has disclosed CVE-2026-3888, a local privilege escalation vulnerability in Ubuntu Desktop 24.04 and later. The flaw exploits an interaction between snap-confine (a setuid root binary) and systemd-tmpfiles: after a 10–30 day cleanup cycle deletes the /tmp/.snap directory, an attacker can recreate it
Table of contents
What is the attack surface for CVE-2026-3888?Exploitation Mechanism:Affected Versions & RemediationTechnical DetailsSecondary Finding: Vulnerability in Ubuntu 25.10 uutils CoreutilsQualys QID Coverage for Detecting the CVE-2026-3888:Discover Vulnerable Assets with Qualys CyberSecurity Asset ManagementEnhancing Your Security Posture with Qualys VMDR to Detect and Remediate the CVE-2026-3888 VulnerabilityAutomatically Patch CVE-2026-3888 with Qualys Patch ManagementSort: