Local-privilege escalation in snapd

Qualys has discovereda local-privilege escalation (LPE) vulnerability affecting UbuntuDesktop 24.04 and later:

This flaw (CVE-2026-3888) allows an unprivileged local attacker toescalate privileges to full root access through the interaction of twostandard system components: snap-confine and systemd-tmpfiles.

More details are available in the securityadvisory. Canonical has published updated packages as well as instructionsfor verifying if a system is vulnerable and how to upgrade if so.