Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit
A high-severity security vulnerability that affects Ubuntu Desktop versions 24.04 and later by default could be used to elevate privileges to the root level.
The vulnerability, identified as CVE-2026-3888 (CVSS score: 7.8), could give an attacker access to a vulnerable system.
According to the Qualys Threat Research Unit (TRU), this vulnerability (CVE-2026-3888) enables an unprivileged local attacker to escalate privileges to full root access through the interaction of two common system components: snap-confine and systemd-tmpfiles. Despite the exploit's time-based window requirement (10–30 days), the host machine is fully compromised as a result.
The issue identified by Qualys is caused by the inadvertent interaction between systemd-tmpfiles, which automatically removes temporar...