TI-2026-29030 Aliases CVE-2026-40225 GHSA-396h-m3pm-fpm5

In udev in systemd before 260, local root execution can occur via malicious hardware…

LOW 29CWE-669Published 2026-04-10 · Updated 2026-04-14

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0015 4th percentileScored 2026-11-07

Fix Partial systemd (systemd): 260Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
systemd	systemd	before 260	260	Patch available	CNA

systemd Vendorsystemd Affected before 260 Fixed in 260 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:systemd_project:systemd::::::::	before 257.13; 258 to before 258.7; 259 to before 259.5	Vulnerable	systemd

cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:* Versions before 257.13; 258 to before 258.7; 259 to before 259.5 Vulnerable ·systemd

Remediation

Fix · CNA systemd (systemd) Fixed in 260

Red Hat 1 advisory

RHSA-2026:7299 Released 2026-04-09 · Red Hat rating Moderate
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images systemd-260.1-2.1.hum1@aarch64, systemd-260.1-2.1.hum1@src, systemd-260.1-2.1.hum1@x86_64 +40

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-04-10
systemd 260
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2026-29031 In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.Priority MEDIUM 64
- TI-2026-29029 Incorrect authorization in systemdPriority LOW 33
- TI-2026-29028 In systemd 258 before 260, a local unprivileged user can trigger an assert when a…Priority LOW 23
Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Fixed	RHSA-2026:7299

Not affected: 5 products

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat OpenShift Container Platform 4

Timeline

2026-10-02 Threatist record created from CVE-2026-40225
2026-10-03 Alias added: GHSA-396h-m3pm-fpm5

References

Advisory 1

https://github.com/systemd/systemd/security/advisories/GHSA-vpfq-8p5f-jcqx

TI-2023-11736 systemd before 247 does not adequately block local privilege escalation for some Sudo… CVSS 3.1HIGH 7.8
TI-2017-06857 In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can… CVSS 3.1HIGH 7.5
TI-2026-29031 In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file. CVSS 3.1MEDIUM 6.4
TI-2022-04038 Information disclosure in systemd CVSS 3.1MEDIUM 5.5
TI-2025-04111 Systemd-coredump: race condition that allows a local attacker to crash a suid program and… CVSS 3.1MEDIUM 4.7
TI-2017-11647 In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS… CVSS 3.1HIGH 7.5

See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences