CVE-2026-3888

Katalog CVE

CVSS 7.8 · High EPSS 0,46%

Kerentanan Privilege Chaining pada canonical ubuntu linux. Skor CVSS 3.1 7.8 (High) menurut ubuntu.com.

Deskripsi (NVD)

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

Rincian

Terbit di NVD

17 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber ubuntu.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-268: Privilege Chaining

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.qualys.com/vulnerabilities-threat-research/2026/03/17/cve-2026-3888-important-snap-flaw-enables-l... mitigasi · advisory pihak ketiga
• https://discourse.ubuntu.com/t/snapd-local-privilege-escalation-cve-2026-3888 mitigasi · advisory pihak ketiga
• https://cdn2.qualys.com/advisory/2026/03/17/snap-confine-systemd-tmpfiles.txt advisory pihak ketiga
• https://ubuntu.com/security/CVE-2026-3888 advisory pihak ketiga
• https://ubuntu.com/security/notices/USN-8102-1 advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/03/18/1 mailing list · advisory pihak ketiga