Systemd CVE-2026-40225

The CVSS 6.4 score reflects a high-impact but constrained-access vulnerability: AV:P (physical) and AC:H (high complexity) significantly limit exploitability compared to network vectors, yet the outcome (root code execution with full system impact: C:H/I:H/A:H) is severe. The physical requirement is a substantial real-world barrier in most enterprise environments, as it demands an attacker to physically introduce malicious hardware into a target system or already have administrative facility access. However, for edge computing deployments, kiosk systems, or environments with weak physical security, this becomes a material risk. The lack of confirmed public exploit code or KEV active exploitation status suggests the vulnerability requires specific hardware crafting and may not be trivially weaponizable. Organizations running systemd 259 or earlier should prioritize patching in high-risk physical environments, but the business risk is lower than network RCE flaws of similar CVSS. SSVC perspective: exploitation is possible but not automatable across arbitrary hardware; technical impact is system-level; users cannot easily detect a compromised device without forensic investigation.

An attacker with physical access to a target system (e.g., a public kiosk, conference room computer, or co-located server) inserts a malicious USB device or peripheral with specially crafted device descriptors or firmware. When the Linux kernel enumerates the hardware and passes device attributes to udevd, the attacker's unsanitized kernel output triggers a code path in udev's rule evaluation that executes arbitrary commands with root privileges. The attacker gains immediate root access and can install persistence mechanisms, exfiltrate sensitive data, or render the system inoperable. No user interaction or credential entry is required; the exploit is triggered automatically upon device insertion if the target system has not been patched to version 260 or later.