Skip to main content

Systemd CVE-2026-40226

| EUVDEUVD-2026-21400 MEDIUM
Use of Less Trusted Source (CWE-348)
2026-04-10 mitre GHSA-hc7r-6254-88w5
Information Disclosure Red Hat Systemd Suse
6.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
SUSE
MEDIUM
qualitative
Red Hat
6.4 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Patch available
Apr 16, 2026 - 05:29 EUVD
260
EUVD ID Assigned
Apr 10, 2026 - 16:00 euvd
EUVD-2026-21400
Analysis Generated
Apr 10, 2026 - 16:00 vuln.today
CVE Published
Apr 10, 2026 - 15:18 nvd
MEDIUM 6.4

DescriptionCVE.org

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.

AnalysisAI

Escape-to-host vulnerability in systemd nspawn (versions 233-259) allows local privileged users to break container isolation via a crafted optional config file, enabling arbitrary code execution on the host system. CVSS 6.4 reflects high integrity and confidentiality impact but requires high privilege and difficult attack conditions. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

systemd's nspawn is a lightweight container runtime that isolates processes using Linux namespaces and cgroups. The vulnerability resides in nspawn's config file parsing logic (CWE-348: Incorrect Calculation of Buffer Size for String Copy), where insufficient validation of optional configuration parameters allows a malicious config to manipulate namespace boundaries or resource restrictions. An attacker with high privileges (root or systemd-nspawn user) within the container or with write access to nspawn configuration directories can craft a config file that bypasses containerization controls, granting access to the host filesystem, network, and process space. The affected CPE cpe:2.3:a:systemd:systemd:*:*:*:*:*:*:*:* spans all systemd installations using nspawn; the version range 233-259 is vulnerable.

RemediationAI

Vendor-released patch: systemd version 260 and later. Affected users should upgrade systemd immediately to version 260 or newer via their distribution's package manager (e.g., apt upgrade systemd on Debian/Ubuntu, dnf upgrade systemd on Fedora/RHEL). Users unable to upgrade immediately should restrict file permissions on nspawn configuration directories (/etc/systemd/nspawn/, /run/systemd/nspawn/, and user-local equivalents) to prevent unauthorized creation or modification of container config files by non-root users. Refer to GitHub Security Advisory GHSA-9mj4-rrc3-gjcx (https://github.com/systemd/systemd/security/advisories/GHSA-9mj4-rrc3-gjcx) for detailed advisory and additional context.

More in Systemd

View all
CVE-2015-7510 CRITICAL POC
9.8 Sep 25

Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. Rated cr
CVE-2013-4391 HIGH POC
7.5 Oct 28

Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cau
CVE-2016-10156 HIGH POC
7.8 Jan 23

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd tim
CVE-2023-26604 HIGH POC
7.8 Mar 03

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible su
CVE-2019-3844 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of

CVE-2019-3843 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allo
CVE-2018-15686 HIGH POC
7.8 Oct 26

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution

CVE-2018-6954 HIGH POC
7.8 Feb 13

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local

CVE-2019-3842 HIGH POC
7.0 Apr 09

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using t
CVE-2018-15687 HIGH POC
7.0 Oct 26

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary
CVE-2017-1000082 CRITICAL
9.8 Jul 07

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. Rated critical severity (CV
CVE-2022-2526 CRITICAL
9.8 Sep 09

A use-after-free vulnerability was found in systemd. Rated critical severity (CVSS 9.8), this vulnerability is remotely

Same weakness CWE-348 – Use of Less Trusted Source

View all
CVE-2022-31813 CRITICAL POC
9.8
CVE-2026-43634 HIGH POC
8.7
CVE-2025-55292 HIGH POC
8.2
CVE-2021-21374 HIGH POC
8.1
CVE-2022-2255 HIGH POC
7.5
CVE-2026-48772 CRITICAL
10.0
CVE-2021-21373 MEDIUM POC
5.9
CVE-2026-58122 CRITICAL
9.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Micro 5.2 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

Share

CVE-2026-40226 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy