Skip to main content

Systemd CVE-2026-40223

| EUVDEUVD-2026-21394 MEDIUM
Incorrect Behavior Order (CWE-696)
2026-04-10 mitre GHSA-52rm-r39v-fwv9
Information Disclosure Systemd
4.7
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-696
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect behavior order
Impact

The CVSS score of 4.7 reflects moderate severity with local attack vector (AV:L), high attack complexity (AC:H), low privileges required (PR:L), no user interaction needed (UI:N), and availability impact only (A:H). The high complexity requirement suggests the vulnerability requires specific preconditions: a unit must be both configured with Delegate=yes and lack an explicit User setting, and must be actively running. The EPSS exploitation probability is not provided, but the low-complexity CVSS vector paired with no public exploit code identified and no KEV status indicates this is primarily a reliability issue rather than an immediate security priority. Real-world risk is constrained by the need for local access and specific unit configurations that may not be common in default deployments.
Exploit ScenarioDerived

An unprivileged local user on a Linux system running systemd 258 or 259 could craft or trigger interaction with a vulnerable service unit (one with Delegate=yes and no User setting) to cause the assertion failure. Because attack complexity is high, the attacker would need specific knowledge of which units have this configuration and how to interact with them, but successful exploitation results in a systemd crash that impacts system availability and potentially service startup/management capabilities until the daemon restarts.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 10, 2026

Local denial of service in systemd 258 through 259 allows unprivileged users to trigger an assertion failure by interacting with service units configured with Delegate=yes and no explicit User setting, causing the systemd daemon to crash. The vulnerability requires local access and specific unit configuration but poses moderate risk to system availability with a CVSS score of 4.7 and no active exploitation currently identified.

RemediationAI

Upgrade systemd to version 260 or later, which contains the fix for this assertion logic error. In the interim, system administrators can mitigate the issue by ensuring all service units with Delegate=yes also have an explicit User parameter defined in their unit configuration files, avoiding the problematic configuration state. See the GitHub security advisory at https://github.com/systemd/systemd/security/advisories/GHSA-x4h8-rrrg-q78f for additional details and confirmation of patched versions.

Affected VersionsENISA

systemd 258 <260

Affected Packages

euvd systemd fix: 260

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Systemd is a system and service manager for Linux that uses unit files to define service behaviors and resource delegation. The vulnerability stems from improper assertion logic (CWE-696: Incorrect Behavior Order) in systemd's handling of delegated cgroups when a unit has Delegate=yes set but no explicit User parameter specified. This configuration state creates a logic error where unprivileged users can reach a code path that triggers an unguarded assert statement, crashing the systemd process. The affected systemd versions are 258 up to but not including 260, identified via CPE cpe:2.3:a:systemd:systemd:*:*:*:*:*:*:*:*.

Know when Systemd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 4.7 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Apr 16, 2026 - 05:29 EUVD
260
CVE Published
Apr 10, 2026 - 15:10 nvd
MEDIUM 4.7

DescriptionCVE.org

In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

24
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +24
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in systemd Multiple Privilege Escalation and DoS

View all 6
CVE-2026-40224 MEDIUM
6.7
CVE-2026-40225 MEDIUM
6.4
CVE-2026-40226 MEDIUM
6.4
CVE-2026-40228 LOW
2.9
CVE-2026-40227 MEDIUM
6.2

More in Systemd

View all
CVE-2015-7510 CRITICAL POC
9.8 Sep 25

Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. Rated cr
CVE-2013-4391 HIGH POC
7.5 Oct 28

Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cau
CVE-2023-26604 HIGH POC
7.8 Mar 03

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible su
CVE-2016-10156 HIGH POC
7.8 Jan 23

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd tim
CVE-2019-3844 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of

CVE-2019-3843 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allo
CVE-2018-15686 HIGH POC
7.8 Oct 26

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution

CVE-2018-6954 HIGH POC
7.8 Feb 13

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local

CVE-2021-33910 MEDIUM POC
5.5 Jul 20

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Val
CVE-2019-3842 HIGH POC
7.0 Apr 09

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using t
CVE-2018-15687 HIGH POC
7.0 Oct 26

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary
CVE-2017-1000082 CRITICAL
9.8 Jul 07

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. Rated critical severity (CV

Same weakness CWE-696 – Incorrect Behavior Order

View all
CVE-2021-31379 HIGH POC
7.5
CVE-2026-44108 CRITICAL
9.3
CVE-2026-45033 HIGH
8.5
CVE-2026-14169 HIGH
8.1
CVE-2026-35386 HIGH
8.1
CVE-2026-110450 HIGH
8.0
CVE-2026-105745 HIGH POC
7.8
CVE-2025-31485 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-40223 ADVISORY https://vuldb.com/vuln/356834 REF https://github.com/systemd/systemd/security/advisories/GHSA-x4h8-rrrg-q78f

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy