Skip to main content

systemd-oomd CVE-2026-15059

| EUVDEUVD-2026-55625 MEDIUM
Path Traversal (CWE-22)
2026-08-10 systemd
Path Traversal Red Hat Systemd Systemd Oomd
5.5
CVSS 3.1 · Vendor: systemd
Share

Severity by source

Vendor (systemd) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local IPC socket access with a standard user account (AV:L, PR:L) enables arbitrary process termination; no confidentiality or integrity impact applies.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (systemd).

CVSS VectorVendor: systemd

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Patch available
Aug 10, 2026 - 15:02 EUVD
Analysis Generated
Aug 10, 2026 - 14:07 vuln.today
CVE Published
Aug 10, 2026 - 13:02 cve.org
MEDIUM 5.5

DescriptionCVE.org

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.

AnalysisAI

systemd-oomd exposes an IPC API that local unprivileged users can abuse to terminate arbitrary processes on the host due to a missing path traversal validation (CWE-22). Any user holding a local shell account can craft IPC requests with traversal sequences to reference processes outside the intended cgroup scope, enabling targeted denial-of-service against critical system services. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

systemd-oomd is the userspace out-of-memory (OOM) manager daemon within the systemd ecosystem, designed to proactively kill processes or cgroups under severe memory pressure before the kernel OOM killer engages. It exposes an IPC API - reachable via a Unix socket or D-Bus interface - that allows interaction from local processes. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) identifies the root cause: the IPC API does not sanitize path components such as '../' sequences in caller-supplied inputs, allowing a low-privileged caller to traverse outside the intended cgroup process tree and reference arbitrary processes for termination. The affected CPE cpe:2.3:a:systemd:systemd-oomd:*:*:*:*:*:*:*:* carries no version upper-bound, indicating all shipped versions are affected as of the advisory.

RemediationAI

Apply the upstream fix documented in systemd security advisory GHSA-652q-wxr6-h5j6 (https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6) by installing the patched systemd package for your distribution. An exact fixed version number is not specified in the available input data - consult the advisory and your distribution's security tracker for the precise patched release. As an immediate workaround, disabling systemd-oomd entirely via 'systemctl disable --now systemd-oomd' eliminates the attack surface but removes automated userspace OOM management, increasing the risk that severe memory pressure events lead to kernel OOM kills or system instability rather than controlled cgroup termination. Alternatively, restricting access to the systemd-oomd IPC socket using systemd unit-level socket activation policies or D-Bus policy rules to whitelist only authorized processes reduces the exposure without fully disabling the service, though misconfiguration may break intended OOM management functionality.

More in Systemd

View all
CVE-2015-7510 CRITICAL POC
9.8 Sep 25

Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. Rated cr
CVE-2013-4391 HIGH POC
7.5 Oct 28

Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cau
CVE-2016-10156 HIGH POC
7.8 Jan 23

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd tim
CVE-2023-26604 HIGH POC
7.8 Mar 03

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible su
CVE-2019-3844 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of

CVE-2019-3843 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allo
CVE-2018-15686 HIGH POC
7.8 Oct 26

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution

CVE-2018-6954 HIGH POC
7.8 Feb 13

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local

CVE-2019-3842 HIGH POC
7.0 Apr 09

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using t
CVE-2018-15687 HIGH POC
7.0 Oct 26

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary
CVE-2017-1000082 CRITICAL
9.8 Jul 07

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. Rated critical severity (CV
CVE-2022-2526 CRITICAL
9.8 Sep 09

A use-after-free vulnerability was found in systemd. Rated critical severity (CVSS 9.8), this vulnerability is remotely

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-15059 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy