CVE Feed

    Dashboard / CVE / CVE-2026-29111

    CVE-2026-29111

    systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

    Published:Mar 23, 2026
    Last Modified:Apr 15, 2026
    EPS:Mar 23, 2026
    EPSS Score:0.00011
    CVSS Score:5.5

    Affected Products

    Vendor
    Systemd
    Product
    Systemd
    Vendor
    Systemd Project
    Product
    Systemd

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-16742 (CVSS 6.7) — systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged…
    CVE-2026-15059 (CVSS 5.5) — Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing p…
    CVE-2026-16552 (CVSS 6.3) — The reported issue is invalid, as it requires root privileges to reproduce, and it is out of scope of the thre…
    CVE-2026-40228 (CVSS 2.9) — In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "lo…
    CVE-2026-40227 (CVSS 6.2) — In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array o…
    CVE-2026-40226 (CVSS 6.4) — In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional con…
    CVE-2026-40225 (CVSS 6.4) — In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized k…
    CVE-2026-40224 (CVSS 6.7) — In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used…
    CVE-2026-40223 (CVSS 4.7) — In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset…

    References

    https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a
    https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6
    https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412
    https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd
    https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f
    https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f
    https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69
    https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6
    https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c
    https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8
    https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High