systemd-oomd CVE-2026-15059

Exploitation requires a local user account with standard (low) privileges - confirmed by CVSS PR:L - on a Linux system where systemd-oomd is installed and the daemon is actively running. The attacker must have access to the systemd-oomd IPC endpoint (Unix socket or D-Bus interface), which is typically accessible to local users without additional configuration. No special system configuration beyond systemd-oomd being enabled is required. Remote-only attackers without a local account cannot exploit this vulnerability. The impact is strictly availability - targeted process termination - with no confidentiality or integrity effect, as confirmed by CVSS C:N/I:N/A:H.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) accurately reflects a locally-confined, low-complexity attack requiring only a standard user account. The impact ceiling is high availability loss - an attacker can kill any running process - but confidentiality and integrity are unaffected, capping the score. No EPSS score is provided in the input data, so exploitation probability cannot be quantified numerically. The absence of a KEV listing and no reported POC suggests this has not seen widespread active exploitation at time of analysis. Despite the moderate CVSS score, the real-world risk is meaningful: a local attacker can selectively kill security monitoring agents, authentication daemons (e.g., sshd, PAM services), or endpoint detection tools, creating a window for privilege escalation or lateral movement. The primary limiting factor is the local access requirement - remote-only attackers cannot exploit this without an initial foothold.

A local user with a standard shell account on a Linux system running systemd-oomd constructs an IPC request containing path traversal sequences (e.g., '../../proc/1') to reference a process outside the caller's cgroup scope. The daemon, lacking traversal validation, accepts the request and sends a termination signal to the referenced process. The attacker can repeat this to kill sshd, an EDR agent, or an audit daemon, clearing defenses before escalating privileges through a secondary vulnerability.