Vulnerabilities

TI-2026-29031 CVE-2026-40226 · GHSA-hc7r-6254-88w5

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.

MEDIUM 64

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.

CVSS 3.1MEDIUM 6.4 Local High privileges No interaction EPSS 0.00075 Published 2026-04-10 Fixed in 260 CWE-348

TI-2026-29030 CVE-2026-40225 · GHSA-396h-m3pm-fpm5

LOW 29

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

CVSS 3.1MEDIUM 6.4 Physical No auth No interaction EPSS 0.0015 Published 2026-04-10 Partial fix · 260 CWE-669

TI-2026-29029 CVE-2026-40224 · GHSA-jf3x-2pf6-c45w

LOW 33

In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.0011 Published 2026-04-10 Fixed in 260 CWE-863

TI-2026-29028 CVE-2026-40223 · GHSA-52rm-r39v-fwv9

LOW 23

In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.0009 Published 2026-04-10 Fixed in 260 CWE-696