Red Hat CVE-2026-40226

systemd's nspawn is a lightweight container runtime that isolates processes using Linux namespaces and cgroups. The vulnerability resides in nspawn's config file parsing logic (CWE-348: Incorrect Calculation of Buffer Size for String Copy), where insufficient validation of optional configuration parameters allows a malicious config to manipulate namespace boundaries or resource restrictions. An attacker with high privileges (root or systemd-nspawn user) within the container or with write access to nspawn configuration directories can craft a config file that bypasses containerization controls, granting access to the host filesystem, network, and process space. The affected CPE cpe:2.3:a:systemd:systemd:*:*:*:*:*:*:*:* spans all systemd installations using nspawn; the version range 233-259 is vulnerable.