Ubuntu Desktop Systems Vulnerability Enables Attackers to Gain Full Root Access

**CVE-2026-3888:** A local privilege escalation in default Ubuntu Desktop installations (24.04 and later) arises from an unintended interaction between snap-confine and systemd-tmpfiles that allows a low-privileged local attacker to replace /tmp/.snap after tmpfiles cleanup and have snap-confine bind-mount attacker-controlled files as root, resulting in full host compromise; CVSS v3.1 7.8. Qualys TRU also identified a race in the uutils `rm` implementation affecting cron-run operations (mitigated by reverting to GNU coreutils), and vendors have released patched snapd versions which should be applied immediately.