Systemd CVE-2026-40227

This denial-of-service vulnerability presents moderate real-world risk with mixed signals. The CVSS score of 6.2 reflects a medium severity rating driven by local attack vector (AV:L) with low attack complexity (AC:L) and no privilege requirement (PR:N), indicating an easily triggerable condition. However, the impact is limited to availability (A:H) with no confidentiality or integrity compromise. The locally-exploitable nature significantly constrains real-world impact compared to remote vulnerabilities, as an attacker must have local system access. No KEV status or public exploit code is confirmed, suggesting limited active exploitation. The EUVD assignment and GitHub security advisory indicate vendor awareness and tracking. From an SSVC perspective: exploitation status is unconfirmed but conditions are straightforward (low complexity, no privilege), technical impact is denial of service (measurable), and exposure is limited to local users. This warrants patching but is not a critical emergency unless the affected system is exposed to untrusted local users.

A local unprivileged user on a system running systemd 260 could craft a specially formed IPC API message containing an array or map with a null element and send it to the systemd daemon. This triggers an assert failure in the message parsing logic, causing the systemd process to crash and briefly disrupt system services. While no public proof-of-concept code is confirmed, the low attack complexity and lack of privilege requirement means exploitation is straightforward for any local user with IPC access.