The vulnerability in snapd on Linux allows a local attacker to obtain root privileges by exploiting the way the service recreates snap's private /tmp directory when systemd-tmpfiles reclaims system temporary files. This flaw, identified as CWE-268 (Missing Authorization Functionality), enables an unauthenticated local user to gain full administrative control over the affected system, compromising confidentiality, integrity, and availability at the host level.

Affected versions include Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS as provided by the vendor. No finer-grained version details are supplied in the CVE data, so all releases of snapd running under Canonical’s Ubuntu distributions are potentially impacted.

The CVSS score of 7.8 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the attack requires local system access, a user who can execute code on the machine may trigger the re-creation of the private /tmp directory and elevate privileges. No mention of network-based exploitation or remote resources is made in the description, so the vector is inferred to be local only.