Discussion

CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

ifh-hn: I wonder if, and this is just speculating not trying to start an arguement, if this sort of thing could have happened in the simpler pre-snap, pre-systemd systems? More to the point is this a cause of using more complicated software?

cyberpunk: > As a side note, we also discovered a local vulnerability (a race condition) in the uutils coreutils (a Rust rewrite of the standard GNU coreutils -- ls, cp, rm, cat, sort, etc), which are installed by default in Ubuntu 25.10. This vulnerability was mitigated in Ubuntu 25.10 before its release (by replacing the uutils coreutils' rm with the standard GNU coreutils' rm), and would otherwise have resulted in an LPE (from any unprivileged user to full root) in the default installation of Ubuntu Desktop 25.10.Shurely Shome mistake, not a vuln in holy rust!

dgxyz: Rewrite tools in new language, get new exciting bugs!

dogleash: Permission and timing gotchas in /tmp predate snap and systemd. It's why things like `mkstemp` exist.I remember cron jobs that did what systemd-tmpfiles-clean does before it existed. All unix daemons using /tmp run the risk of misusing /tmp. I don't know snap well enough to say anything about it makes it uniquely more susceptible to that.

SoftTalker: The mistake seems to be using a predictable path (/tmp/.snap) in a publicly-writable directory.

rglover: Semi-related: does anybody know of a reliable API that announces CVEs as they're published?