EUVD-2026-12570Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal attacker monitors snap /tmp directory
-
DeliveryWait for systemd-tmpfiles cleanup cycle
-
ExploitRecreate snap private directory with malicious permissions
-
ExecutionInject code into snap process
-
ImpactEscalate privileges to root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V8 - Authorization Privilege chaining prevention
|
| Exploitation Conditions | Local user account required on system running snapd with systemd-tmpfiles service enabled and configured to automatically clean snap temporary directories on Ubuntu 16.04 LTS through 24.04 LTS. |
| Impact | The CVSS 3.1 score of 7.8 (High) reflects local access requirements (AV:L) with high attack complexity (AC:H) and low privileges needed (PR:L), resulting in complete compromise of confidentiality, integrity, and availability. However, the real-world risk appears moderate based on several factors: the attack requires existing local access with authenticated user privileges, has high complexity requiring precise timing, and no known exploitation in the wild. The vulnerability lacks presence in CISA's Known Exploited Vulnerabilities catalog and has no reported proof-of-concept code. The SSVC decision framework would likely categorize this as 'Attend' rather than 'Act' due to the local nature, high complexity, and lack of automation potential. Organizations should prioritize this based on their exposure to untrusted local users rather than treating it as a critical remote vulnerability. |
| Exploit ScenarioDerived | An attacker with local access and low-level user privileges monitors systemd-tmpfiles cleanup cycles and waits for the scheduled deletion of snap's private /tmp directory. When the cleanup occurs, the attacker rapidly recreates the directory with malicious permissions before snapd can properly secure it, exploiting the race condition to gain root privileges. The high attack complexity stems from the precise timing required and the need to understand systemd-tmpfiles scheduling patterns on the target system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
Local privilege escalation in snapd on multiple Ubuntu versions allows authenticated local attackers to obtain root access by exploiting a race condition between snap's temporary directory creation and systemd-tmpfiles cleanup operations. An attacker with local access can manipulate the /tmp directory to escalate privileges when snapd attempts to recreate its private snap directories. This vulnerability affects Ubuntu 16.04 LTS through 24.04 LTS with no patch currently available.
Earlier versions of this analysis (1)
A local privilege escalation vulnerability in snapd allows low-privileged users to gain root access by exploiting a race condition with systemd-tmpfiles cleanup of snap's private /tmp directory. The vulnerability affects all Ubuntu LTS releases from 16.04 through 24.04 and requires local access with existing low privileges. While no active exploitation has been reported and no public proof-of-concept exists, the vulnerability has a moderate exploitation probability and patches are available through Ubuntu Security Notices.
RemediationAI
Apply the security updates provided in Ubuntu Security Notice USN-8102-1 by upgrading snapd to the patched versions: 2.61.4ubuntu0.16.04.1+esm2 for Ubuntu 16.04, 2.61.4ubuntu0.18.04.1+esm2 for Ubuntu 18.04, 2.67.1+20.04ubuntu1~esm1 for Ubuntu 20.04, 2.73+ubuntu22.04.1 for Ubuntu 22.04, or 2.73+ubuntu24.04.1 for Ubuntu 24.04. Update using standard package management commands: sudo apt update && sudo apt upgrade snapd. As a temporary mitigation until patching is complete, consider disabling systemd-tmpfiles automatic cleanup of snap's private temporary directories or implementing strict monitoring of privilege escalation attempts through audit logs, though patching remains the recommended solution.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in snapd, Ubuntu's universal package management system for snap packages, and is classified as CWE-268 (Privilege Chaining). Based on the CPE data, this affects Ubuntu LTS releases 16.04, 18.04, 20.04, 22.04, and 24.04. The issue arises from improper handling of snap's private temporary directory when systemd-tmpfiles is configured to automatically clean temporary files - an attacker can exploit the window between directory deletion and recreation to escalate privileges. This represents a classic time-of-check to time-of-use (TOCTOU) condition in privilege-sensitive directory operations.
Know when Ubuntu 20 04 Lts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.
Executive ViewAI
A local privilege escalation vulnerability in snapd could allow authorized system users to gain root-level access on Ubuntu systems across all LTS versions (16.04-24.04). This poses a significant risk to organizations running Ubuntu infrastructure, as compromised standard user accounts could escalate to full system control, enabling data exfiltration, malware deployment, and lateral movement.
Restrict local user account creation and access to systems where feasible; disable snapd on non-essential systems; implement strict sudo/privilege escalation controls and logging; enforce SELinux or AppArmor policies to restrict snap process capabilities; monitor system logs for privilege escalation attempts; segment Ubuntu systems by criticality and apply additional access controls to high-value assets pending patch deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Ubuntu 20 04 Lts
View allRoot-level remote code execution in Canonical's ubuntu-pro-client (formerly ubuntu-advantage-tools) allows an attacker w
TLS trust store poisoning in Canonical ADSys through v0.16.2 allows a network-positioned attacker to inject an arbitrary
Sandbox confinement bypass in Canonical snapd (snap-confine) affects all supported Ubuntu LTS releases (16.04 through 26
ubuntu-pro-client (formerly ubuntu-advantage-tools) leaks Ubuntu Pro bearer tokens to unprivileged local users via the L
Insecure symlink following in Canonical's ubuntu-pro-client `pro collect-logs` command allows a low-privileged local att
Same weakness CWE-268 – Privilege Chaining
View allSame technique Privilege Escalation
View allVendor StatusVendor
Ubuntu
Priority: High| Release | Status | Version |
|---|---|---|
| upstream | pending | 2.75.1 |
| bionic | released | 2.61.4ubuntu0.18.04.1+esm2 |
| focal | released | 2.67.1+20.04ubuntu1~esm1 |
| jammy | released | 2.73+ubuntu22.04.1 |
| noble | released | 2.73+ubuntu24.04.1 |
| questing | released | 2.73+ubuntu25.10.1 |
| xenial | released | 2.61.4ubuntu0.16.04.1+esm2 |
Debian
Bug #1131120| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye (security), bullseye | vulnerable | 2.49-1+deb11u2 | - |
| bookworm | vulnerable | 2.57.6-1 | - |
| trixie | vulnerable | 2.68.3-3 | - |
| forky | vulnerable | 2.71-3 | - |
| sid | vulnerable | 2.74.1-1 | - |
| (unstable) | fixed | (unfixed) | - |
Exploit-DB