CVE-2026-29111

EUVD-2026-14562
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 5%
Affected Products (NVD)
VendorProductVersion
systemd_projectsystemd
239 ≤
𝑥
< 257.11
systemd_projectsystemd
258 ≤
𝑥
< 258.5
systemd_projectsystemd
259 ≤
𝑥
< 259.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
systemd
bookworm
no-dsa
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
247.3-7+deb11u8
fixed
forky
260.1-1
fixed
sid
260.1-1
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
systemd
bionic
not-affected
focal
Fixed 245.4-4ubuntu3.24+esm3
released
jammy
Fixed 249.11-0ubuntu3.19
released
noble
Fixed 255.4-1ubuntu8.14
released
questing
Fixed 257.9-0ubuntu2.3
released
trusty
not-affected
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libsystemd0
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
libsystemd0-32bit
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
libudev1
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
libudev1-32bit
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
systemd
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
systemd-32bit
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
systemd-container
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
systemd-coredump
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
systemd-devel
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
systemd-doc
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
systemd-journal-remote
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
systemd-lang
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
systemd-resolved
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
systemd-sysvcompat
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
systemd-sysvinit
suse enterprise sap 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP5
249.17-150400.8.55.1
fixed
udev
suse enterprise desktop 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise sap 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise sap 15 SP7
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP4
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP5
249.17-150400.8.55.1
fixed
suse enterprise server 15 SP6
254.27-150600.4.62.1
fixed
suse enterprise server 15 SP7
254.27-150600.4.62.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
rhel-net-naming-sysattrs
RHEL 9
0:252-55.el9_7.9
fixed
systemd
RHEL 9
0:252-55.el9_7.9
fixed
systemd-boot-unsigned
RHEL 9
0:252-55.el9_7.9
fixed
systemd-container
RHEL 9
0:252-55.el9_7.9
fixed
systemd-devel
RHEL 9
0:252-55.el9_7.9
fixed
systemd-journal-remote
RHEL 9
0:252-55.el9_7.9
fixed
systemd-libs
RHEL 9
0:252-55.el9_7.9
fixed
systemd-oomd
RHEL 9
0:252-55.el9_7.9
fixed
systemd-pam
RHEL 9
0:252-55.el9_7.9
fixed
systemd-resolved
RHEL 9
0:252-55.el9_7.9
fixed
systemd-rpm-macros
RHEL 9
0:252-55.el9_7.9
fixed
systemd-udev
RHEL 9
0:252-55.el9_7.9
fixed
systemd-ukify
RHEL 9
0:252-55.el9_7.9
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a
https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6
https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412
https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd
https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f
https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f
https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69
https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6
https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c
https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8
https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764