Systemd CVE-2026-40226

CVSS 6.4 indicates moderate-to-high risk, but real-world exploitation is significantly constrained. Attack Vector Local (AV:L) and Privilege Required High (PR:H) mean only trusted users with administrative capabilities can exploit this; the high attack complexity (AC:H) suggests the crafted config must meet precise structural or timing conditions. CVSS alone does not capture that nspawn is typically deployed in controlled environments (CI/CD, development, trusted hosting scenarios) where an already-privileged user executing the attack represents an insider threat rather than a remote adversary risk. EPSS and KEV status are not provided, but the absence of public exploit code and the requirement for high privilege significantly reduce practical exploitation probability compared to the CVSS score alone. SSVC framing: exploitation is possible but requires non-trivial conditions; technical impact is high (host compromise) if achieved, but exploitability remains bounded by authentication and privilege gates. This is a genuine vulnerability requiring patching, but not a widespread critical risk.

A system administrator or container orchestration operator (e.g., root or a privileged systemd-nspawn user) with write access to systemd nspawn configuration directories crafts a malicious .nspawn config file with specially-formatted parameters that bypass namespace validation logic. When nspawn parses this config during container startup, the vulnerability allows the attacker to disable or modify isolation restrictions, granting container processes access to the host's root filesystem, network interfaces, and privileged system calls. This enables the attacker to exfiltrate sensitive data, modify host system files, or inject malicious code into the host environment.