Loading story…
Qualys disclosed CVE-2026-3888, a high-severity local privilege escalation flaw affecting default installations of Ubuntu Desktop 24.04 and later. The bug arises from the interaction between snap-confine, the setuid-root component used to build snap sandboxes, and systemd-tmpfiles, which periodically cleans stale data from temporary directories. An unprivileged local attacker can abuse the cleanup of /tmp/.snap, recreate the directory with malicious content, and eventually obtain full root access. The issue is rated CVSS 7.8 and requires low privileges and no user interaction, but exploitation is constrained by a time-based window tied to the system's cleanup schedule.
The vulnerable behavior is present in default Ubuntu Desktop deployments because both components are standard parts of the platform's snap confinement model. Reports note the cleanup interval is typically 30 days on Ubuntu 24.04 and 10 days on later versions, which contributes to the exploit's higher attack complexity. Patched versions include snapd 2.73+ubuntu24.04.1 for Ubuntu 24.04 LTS, 2.73+ubuntu25.10.1 for Ubuntu 25.10 LTS, 2.74.1+ubuntu26.04.1 for Ubuntu 26.04 development builds, and upstream snapd 2.75. A separate report about CVE-2026-32746 in GNU InetUtils telnetd describes a different, unrelated unauthenticated remote code execution issue and does not pertain to the Ubuntu snap-confine flaw.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Qualys Threat Research Unit disclosed CVE-2026-3888, a high-severity local privilege escalation vulnerability caused by an interaction between snap-confine and systemd-tmpfiles. The bug lets an attacker abuse cleanup and recreation of /tmp/.snap so attacker-controlled files may be bind-mounted as root, potentially leading to full system compromise.
Canonical issued patched snapd releases to address CVE-2026-3888 for Ubuntu 24.04 LTS, Ubuntu 25.10, Ubuntu 26.04 LTS (Dev), and upstream snapd. The flaw affects default Ubuntu Desktop 24.04 and later installations and can allow a low-privileged local user to gain full root access.
During review of Ubuntu 25.10, Qualys identified a separate race condition in the uutils coreutils rm utility that could enable arbitrary file deletion as root or further privilege escalation. Ubuntu mitigated the issue before the public release of Ubuntu 25.10 by reverting the default rm command to GNU coreutils, and upstream uutils fixes were later applied.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceitpro.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Canonical disclosed and patched three **snapd** vulnerabilities, led by **CVE-2026-8933**, a high-severity local privilege escalation flaw in **snap-confine** that can let a local user gain **root** on affected Ubuntu Desktop systems. Qualys reported that Ubuntu Desktop 26.04, 25.10, and fully updated 24.04 installations using the file-capabilities configuration for `snap-confine` are exposed because the process retains near-root capabilities while operating with the attacker’s effective UID, allowing attacker-owned files and directories to be created during a race window. The flaw can be exploited through symlink-based arbitrary file creation and permission changes, then by planting a malicious udev rule in an AppArmor-permitted path under `/run/udev/`, which can be triggered to execute attacker-controlled commands as root via `systemd-udevd`. Canonical also addressed **CVE-2026-15226**, a **snap-confine** sandbox confinement bypass caused by missing `setuid` restrictions in seccomp templates, which could let code running inside a strictly confined snap create or manipulate setuid binaries and weaken confinement boundaries. A third issue, **CVE-2024-5300**, involved an AppArmor base profile misconfiguration that could expose hashed passwords through `systemd-userdbd`. Fixes are scheduled in **snapd 2.76.1** and corresponding Ubuntu package updates for Xenial, Bionic, Focal, Jammy, Noble, and Resolute, with Canonical publishing advisory **USN-8579-1**; Qualys said it had a working exploit for CVE-2026-8933 but reported no evidence of active exploitation.
Aug 11, 2026
Researchers and vendors disclosed **CVE-2026-46333**, a Linux kernel flaw in `__ptrace_may_access()` that lets an unprivileged local user exploit a process-exit race to bypass authorization checks and steal file descriptors from privileged processes. The bug has existed since Linux `v4.10-rc1`, and exploitation became more practical with `pidfd_getfd()` introduced in `v5.6-rc1`. Qualys and public proof-of-concept authors showed the issue can expose `/etc/shadow`, leak OpenSSH host private keys through `ssh-keysign`, and in some cases execute commands as root via targets including `chage`, `pkexec`, and `accounts-daemon` on default Debian, Ubuntu, Fedora, AlmaLinux, and other distributions. Linus Torvalds merged the upstream fix in commit `31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a`, and stable kernel updates were released across multiple branches as distributions began shipping patched packages. Public exploit code appeared almost immediately after the fix became visible, increasing the urgency for defenders to patch and reboot affected systems, rotate potentially exposed **SSH host keys** and other credentials, and review systems for local privilege-escalation activity. Where immediate patching is not possible, several vendors and Qualys said raising `kernel.yama.ptrace_scope` to `2` or `3` can block known exploit paths, although maintainers cautioned that such settings are only a temporary workaround and may disrupt debugging tools.
Aug 25, 2026
SUSE disclosed four vulnerabilities in qSnapper’s privileged root D-Bus service, affecting versions through **1.3.2** and tracked as `CVE-2026-41045` through `CVE-2026-41048`. The flaws include a **Polkit race-condition authentication bypass**, a **path traversal** issue in the `configName` parameter, **information disclosure** through snapshot diff methods, and unsafe **authentication caching** that could allow one user’s authorization to be reused by another. SUSE said some bug chains could lead to **full local root exploitation**, while other impacts include denial of service, arbitrary file operations, and exposure of sensitive content such as diffs involving `/etc/shadow`. Upstream released **qSnapper 1.3.3** with fixes that change Polkit subject handling, validate `configName`, remove authentication caching, restrict diff access behind a new **`view-diff`** Polkit action, remove the unauthenticated `Quit` method, and harden log file permissions. SUSE also acknowledged additional defense-in-depth weaknesses in file restore logic that could support symlink-based privilege escalation or arbitrary file operations, but said those issues were not assigned separate CVEs and will be addressed later through open development.
Jun 29, 2026