Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit
Summary: Qualys Threat Research Unit disclosed CVE-2026-3888, a high-severity flaw (CVSS 7.8) in default Ubuntu Desktop 24.04 and later installations that lets an unprivileged local attacker escalate to full root access through the interaction of snap-confine and systemd-tmpfiles. The exploit requires a time-based window of 10 to 30 days, manipulating the timing of systemd-tmpfiles cleanup cycles in /tmp, and has been patched in the affected versions. Qualys also found a race condition in the uutils coreutils package allowing an unprivileged local attacker to replace directory entries with symlinks during root-owned cron executions, leading to arbitrary file deletion as root or further privilege escalation.
What's compelling: A local attacker with no privileges and no user interaction can take full root control of a default Ubuntu Desktop install, and the only barrier is waiting 10 to 30 days for a cleanup cycle to line up.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-3888
- Related