Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit

A high-severity local privilege escalation vulnerability (CVE-2026-3888, CVSS 7.8) affects default Ubuntu Desktop installs (24.04+): by exploiting the interaction between snap-confine and systemd-tmpfiles and leveraging a 10–30 day timing window, an unprivileged local attacker can obtain root access; a separate uutils coreutils race allows symlink-based attacks during root cron runs. Vendor and upstream fixes for snapd and uutils have been released for affected versions.