Skip to main content

systemd-homed CVE-2026-16742

| EUVDEUVD-2026-55626 MEDIUM
Improper Privilege Management (CWE-269)
2026-08-10 systemd
Privilege Escalation Red Hat Systemd Systemd Homed
6.7
CVSS 3.1 · Vendor: systemd
Share

Severity by source

Vendor (systemd) PRIMARY
6.7 MEDIUM
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
6.7 MEDIUM

Local access with low privileges required; high complexity and user interaction gate exploitation; arbitrary group membership yields full CIA compromise on typical Linux systems.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (systemd).

CVSS VectorVendor: systemd

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch available
Aug 10, 2026 - 15:02 EUVD
Analysis Generated
Aug 10, 2026 - 14:06 vuln.today

DescriptionCVE.org

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user

AnalysisAI

Local privilege escalation in systemd-homed enables a low-privileged, locally logged-in user whose account is managed by homed to be arbitrarily added to system groups they are not authorized to join. Successful exploitation, constrained by high attack complexity and a required user interaction step per the CVSS vector, can yield full confidentiality, integrity, and availability compromise of the local system. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.

Technical ContextAI

systemd-homed is a systemd subsystem introduced to manage portable, self-contained user home directories with user records stored in LUKS-encrypted images or JSON-signed records. It differs from traditional PAM/shadow-based user management in that user identity and group membership can be asserted from the user record itself rather than solely from /etc/group. The flaw appears to reside in insufficient validation of group assignment operations, allowing a homed-managed user to influence or trigger addition to arbitrary system groups (e.g., sudo, docker, disk, wheel). The CWE is not specified in the available intelligence - the root cause class is inferred from the description as improper authorization or improper privilege management. The CPE string cpe:2.3:a:systemd:systemd-homed:*:*:*:*:*:*:*:* carries no version bounds, indicating the reporter has not yet constrained the affected range in NVD.

RemediationAI

The primary remediation is to apply the upstream fix released by the systemd project, details of which are documented at https://github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv - exact patched version numbers are not available in the current intelligence data and must be confirmed there before deployment. Linux distribution security teams (Red Hat, Debian, Ubuntu, Arch, etc.) typically backport such fixes; check your distribution's security errata for updated systemd packages. As a compensating control where homed-managed accounts are not required, administrators can disable and stop the systemd-homed service with 'systemctl disable --now systemd-homed', though this will prevent homed-managed users from authenticating and their encrypted home directories from being mounted - evaluate the operational impact before applying. Where homed accounts must remain active, auditing current group memberships of all homed-managed users against expected policy can help detect exploitation that may have already occurred.

More in Systemd

View all
CVE-2015-7510 CRITICAL POC
9.8 Sep 25

Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. Rated cr
CVE-2013-4391 HIGH POC
7.5 Oct 28

Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cau
CVE-2016-10156 HIGH POC
7.8 Jan 23

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd tim
CVE-2023-26604 HIGH POC
7.8 Mar 03

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible su
CVE-2019-3844 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of

CVE-2019-3843 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allo
CVE-2018-15686 HIGH POC
7.8 Oct 26

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution

CVE-2018-6954 HIGH POC
7.8 Feb 13

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local

CVE-2019-3842 HIGH POC
7.0 Apr 09

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using t
CVE-2018-15687 HIGH POC
7.0 Oct 26

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary
CVE-2017-1000082 CRITICAL
9.8 Jul 07

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. Rated critical severity (CV
CVE-2022-2526 CRITICAL
9.8 Sep 09

A use-after-free vulnerability was found in systemd. Rated critical severity (CVSS 9.8), this vulnerability is remotely

Same weakness CWE-269 – Improper Privilege Management

View all
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2012-3993 CRITICAL POC
9.3
CVE-2017-11467 CRITICAL POC
9.8
CVE-2014-1510 CRITICAL POC
9.8
CVE-2014-1511 CRITICAL POC
9.8
CVE-2019-1405 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP6-CHOST-BYOS Not-Affected
SLES15-SP6-CHOST-BYOS-Aliyun Not-Affected
SLES15-SP6-CHOST-BYOS-Azure Not-Affected
SLES15-SP6-CHOST-BYOS-EC2 Not-Affected

Share

CVE-2026-16742 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy