Skip to main content

Systemd EUVDEUVD-2026-21402

| CVE-2026-40227 MEDIUM
Comparison Using Wrong Factors (CWE-1025)
2026-04-10 mitre GHSA-x53v-pxf5-chx6
Information Disclosure Red Hat Systemd Suse
6.2
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch available
Apr 16, 2026 - 05:29 EUVD
261
EUVD ID Assigned
Apr 10, 2026 - 16:00 euvd
EUVD-2026-21402
Analysis Generated
Apr 10, 2026 - 16:00 vuln.today
CVE Published
Apr 10, 2026 - 15:19 nvd
MEDIUM 6.2

DescriptionCVE.org

In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.

AnalysisAI

Denial of service in systemd 260 allows local unprivileged users to crash the systemd daemon by triggering an assert via IPC API calls containing arrays or maps with null elements. The vulnerability affects systemd versions 260 through 260, with no public exploit code identified at time of analysis. EPSS score of 6.2 reflects moderate real-world risk due to local-only attack vector and non-privileged requirements.

Technical ContextAI

The vulnerability exists in systemd's IPC (inter-process communication) API message parsing logic, specifically in handling of structured data types (arrays and maps) that contain null elements. The root cause is classified as CWE-1025 (Comparison Using Wrong Factors), indicating improper validation or comparison logic when processing array or map elements during deserialization. This allows specially crafted IPC messages to bypass input validation and trigger an assert statement in the systemd daemon process, which crashes the service. The affected product is the systemd system and service manager (CPE: cpe:2.3:a:systemd:systemd:*:*:*:*:*:*:*:*), which handles critical system initialization, logging, and process management on Linux systems.

RemediationAI

Upgrade systemd to version 261 or later to resolve this vulnerability. Users of systemd 260 should prioritize this patch as it addresses a locally-triggerable denial-of-service condition. Most Linux distributions provide systemd updates through standard package managers; check your distribution's security advisory for release timeline and availability. For environments unable to update immediately, restrict local system access to trusted users only and monitor system logs for unexpected systemd restarts or crashes. Consult the vendor advisory at https://github.com/systemd/systemd/security/advisories/GHSA-848h-497j-8vjq for distribution-specific guidance.

More in Systemd

View all
CVE-2015-7510 CRITICAL POC
9.8 Sep 25

Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd. Rated cr
CVE-2013-4391 HIGH POC
7.5 Oct 28

Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cau
CVE-2016-10156 HIGH POC
7.8 Jan 23

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd tim
CVE-2023-26604 HIGH POC
7.8 Mar 03

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible su
CVE-2019-3844 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of

CVE-2019-3843 HIGH POC
7.8 Apr 26

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allo
CVE-2018-15686 HIGH POC
7.8 Oct 26

A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd re-execution

CVE-2018-6954 HIGH POC
7.8 Feb 13

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local

CVE-2019-3842 HIGH POC
7.0 Apr 09

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using t
CVE-2018-15687 HIGH POC
7.0 Oct 26

A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary
CVE-2017-1000082 CRITICAL
9.8 Jul 07

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. Rated critical severity (CV
CVE-2022-2526 CRITICAL
9.8 Sep 09

A use-after-free vulnerability was found in systemd. Rated critical severity (CVSS 9.8), this vulnerability is remotely

Same weakness CWE-1025 – Comparison Using Wrong Factors

View all
CVE-2025-71377 HIGH
8.7
CVE-2026-75840 HIGH
8.7
CVE-2024-20342 HIGH
8.6
CVE-2026-9800 HIGH
8.1
CVE-2026-29811 HIGH
7.7
CVE-2026-48860 HIGH
7.5
CVE-2025-32464 MEDIUM
6.8
CVE-2026-40880 HIGH
7.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

EUVD-2026-21402 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy