CVE-2026-16742
systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user
- Record
CVE-2026-16742- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-347, CWE-269
- Updated
- 2026-11-02
EUVDEUVD-2026-55626
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user
- Record
EUVD-2026-55626- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user
- Record
CVE-2026-16742- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-269, CWE-347
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-16742
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user
- Record
DEBIAN-CVE-2026-16742- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-3742
systemd security update
systemd is a system and service manager that runs as PID 1 and starts the rest of the system.
Security Fix(es):
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user, due to missing home-record signature verification on the authenticate path.(CVE-2026-16742)
- Record
OESA-2026-3742- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-3743
systemd security update
systemd is a system and service manager that runs as PID 1 and starts the rest of the system.
Security Fix(es):
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user, due to missing home-record signature verification on the authenticate path.(CVE-2026-16742)
- Record
OESA-2026-3743- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVOESA-2026-3744
systemd security update
systemd is a system and service manager that runs as PID 1 and starts the rest of the system.
Security Fix(es):
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user, due to missing home-record signature verification on the authenticate path.(CVE-2026-16742)
- Record
OESA-2026-3744- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-3897
systemd security update
systemd is a system and service manager that runs as PID 1 and starts the rest of the system.
Security Fix(es):
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user, due to missing home-record signature verification on the authenticate path.(CVE-2026-16742)
- Record
OESA-2026-3897- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-16742
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user
- Record
UBUNTU-CVE-2026-16742- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-95643 No score
CVE-2026-16742 affecting package systemd for versions less than 255-34
systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user
- Record
AZL-95643- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:21754-1 No score
Security update for systemd
This update for systemd fixes the following issue:
Security issue fixed:
- CVE-2026-16742:
systemd-homed: local privilege escalation due to missing home record signature verification on the authentication path (bsc#1271444).
Non security issue fixed:
systemd-resolvedfails to start due to write access totmpfsdenied (bsc#1237515).
- Record
openSUSE-SU-2026:21754-1- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-16742 No score
CVE-2026-16742 in systemd - Patched by Root
Root has patched CVE-2026-16742 in the systemd package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-16742- Updated
- 2026-11-02
OSVSUSE-SU-2026:23454-1 No score
Security update for systemd
This update for systemd fixes the following issue:
Security issue fixed:
- CVE-2026-16742:
systemd-homed: local privilege escalation due to missing home record signature verification on the authentication path (bsc#1271444).
Non security issue fixed:
systemd-resolvedfails to start due to write access totmpfsdenied (bsc#1237515).
- Record
SUSE-SU-2026:23454-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23470-1 No score
Security update for systemd
This update for systemd fixes the following issue:
Security issue fixed:
- CVE-2026-16742:
systemd-homed: local privilege escalation due to missing home record signature verification on the authentication path (bsc#1271444).
Non security issue fixed:
systemd-resolvedfails to start due to write access totmpfsdenied (bsc#1237515).
- Record
SUSE-SU-2026:23470-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23620-1 No score
Security update for systemd
This update for systemd fixes the following issue:
Security issue fixed:
- CVE-2026-16742:
systemd-homed: local privilege escalation due to missing home record signature verification on the authentication path (bsc#1271444).
Non security issue fixed:
systemd-resolvedfails to start due to write access totmpfsdenied (bsc#1237515).
- Record
SUSE-SU-2026:23620-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
systemdAzure Linux:3 |
before 255-34 | 255-34 |
systemdDebian:12 |
All versions, plus listed versions 252.11-1252.11-1~deb12u1252.12-1~deb12u1252.14-1~deb12u1252.16-1~deb12u1 Show 45 moreShow less252.17-1~deb12u1252.18-1~deb12u1252.19-1~deb12u1252.20-1~deb12u1252.21-1~deb12u1252.22-1~deb12u1252.23-1~deb12u1252.24-1~deb12u1252.25-1~deb12u1252.26-1~deb12u1252.26-1~deb12u2252.26-1~deb12u2~bpo11+1252.27-1~deb12u1252.28-1~deb12u1252.29-1~deb12u1252.29-1~deb12u1~bpo11+1252.30-1~deb12u1252.30-1~deb12u2252.31-1~deb12u1252.32-1~deb12u1252.33-1~deb12u1252.36-1~deb12u1252.38-1~deb12u1252.39-1~deb12u1252.39-1~deb12u2252.6-1252.6-1+loong64253-1253-2253-3253-4253.5-1253~rc2-1253~rc3-1254-1254.1-1254.1-2254.1-3254.14-1~bpo12+1254.15-1~bpo12+1254.16-1~bpo12+1254.22-1~bpo12+1254.26-1~bpo12+1254.3-1254.4-1 |
None known |
systemdDebian:13 |
All versions, plus listed versions 257.13-1~deb13u1257.7-1257.8-1~deb13u1257.8-1~deb13u2257.9-1~deb13u1 Show 36 moreShow less258-1258.1-1258.1-2258~rc1-1258~rc2-1258~rc2-2258~rc3-1258~rc4-1259-1259.1-1259~rc1-1259~rc2-1259~rc3-1260-1260.1-1260~rc1-1260~rc1-2260~rc2-1260~rc3-1260~rc4-1261-1261-2261.1-1261.1-2261.1-3261.2-1261~rc1-1261~rc2-1261~rc3-1261~rc4-1262-1262.1-1262~rc1-1262~rc1-2262~rc2-1262~rc3-1 |
None known |
systemdDebian:14 |
before 261.2-1, plus listed versions 257.13-1~deb13u1257.7-1257.8-1~deb13u1257.8-1~deb13u2257.9-1~deb13u1 Show 29 moreShow less258-1258.1-1258.1-2258~rc1-1258~rc2-1258~rc2-2258~rc3-1258~rc4-1259-1259.1-1259~rc1-1259~rc2-1259~rc3-1260-1260.1-1260~rc1-1260~rc1-2260~rc2-1260~rc3-1260~rc4-1261-1261-2261.1-1261.1-2261.1-3261~rc1-1261~rc2-1261~rc3-1261~rc4-1 |
261.2-1 |
systemdopenEuler:22.03-LTS-SP4 |
before 249-116.oe2203sp4 | 249-116.oe2203sp4 |
systemdopenEuler:24.03-LTS-SP1 |
before 255-61.oe2403sp1 | 255-61.oe2403sp1 |
systemdopenEuler:24.03-LTS-SP4 |
before 255-61.oe2403sp4 | 255-61.oe2403sp4 |
systemdopenEuler:24.03-LTS-SP3 |
before 255-61.oe2403sp3 | 255-61.oe2403sp3 |
systemdRoot:Debian:13 |
before 257.13-1~deb13u1.aikido.5 | 257.13-1~deb13u1.aikido.5 |
rootio-systemdRoot:Debian:13 |
before 257.13-1~deb13u1.aikido.5 | 257.13-1~deb13u1.aikido.5 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
systemdSUSE:Linux Micro Extras 6.2 From an advisory covering 4 CVEs |
before 257.13-160000.4.1 | 257.13-160000.4.1 |
systemdSUSE:Linux Micro 6.2 From an advisory covering 4 CVEs |
before 257.13-160000.4.1 | 257.13-160000.4.1 |
systemdSUSE:Linux Enterprise Server 16.0 From an advisory covering 4 CVEs |
before 257.13-160000.4.1 | 257.13-160000.4.1 |
systemdSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 4 CVEs |
before 257.13-160000.4.1 | 257.13-160000.4.1 |
systemdUbuntu:22.04:LTS |
before 249.11-0ubuntu3.22, plus listed versions 248.3-1ubuntu8249.5-2ubuntu1249.5-2ubuntu2249.5-2ubuntu3249.5-2ubuntu4 Show 21 moreShow less249.9-0ubuntu2249.10-0ubuntu1249.10-0ubuntu2249.11-0ubuntu1249.11-0ubuntu2249.11-0ubuntu3249.11-0ubuntu3.1249.11-0ubuntu3.3249.11-0ubuntu3.4249.11-0ubuntu3.6249.11-0ubuntu3.7249.11-0ubuntu3.9249.11-0ubuntu3.10249.11-0ubuntu3.11249.11-0ubuntu3.12249.11-0ubuntu3.15249.11-0ubuntu3.16249.11-0ubuntu3.17249.11-0ubuntu3.19249.11-0ubuntu3.20249.11-0ubuntu3.21 |
249.11-0ubuntu3.22 |
systemdUbuntu:24.04:LTS |
before 255.4-1ubuntu8.17, plus listed versions 253.5-1ubuntu6253.5-1ubuntu7255.2-3ubuntu2255.4-1ubuntu5255.4-1ubuntu6 Show 14 moreShow less255.4-1ubuntu7255.4-1ubuntu8255.4-1ubuntu8.1255.4-1ubuntu8.2255.4-1ubuntu8.4255.4-1ubuntu8.5255.4-1ubuntu8.6255.4-1ubuntu8.8255.4-1ubuntu8.10255.4-1ubuntu8.11255.4-1ubuntu8.12255.4-1ubuntu8.14255.4-1ubuntu8.15255.4-1ubuntu8.16 |
255.4-1ubuntu8.17 |
systemdUbuntu:26.04:LTS |
before 259.5-0ubuntu3.4, plus listed versions 257.9-0ubuntu2259-1ubuntu2259-1ubuntu3259.3-0ubuntu1259.5-0ubuntu1259.5-0ubuntu2259.5-0ubuntu3259.5-0ubuntu3.3 |
259.5-0ubuntu3.4 |
systemdopenSUSE:Leap 16.0 From an advisory covering 4 CVEs |
before 257.13-160000.4.1 | 257.13-160000.4.1 |
systemd-miniopenSUSE:Leap 16.0 From an advisory covering 4 CVEs |
before 257.13-160000.4.1 | 257.13-160000.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-16742 is a medium vulnerability (CVSS 6.7) in Systemd Systemd-homed, published August 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.06%, the 0th percentile. Fixed in systemd 255-34.
References
github.com/systemd/systemd/security/advisories/GHSA-jm29-p7hh-vjhv
nvd.nist.gov/vuln/detail/CVE-2026-16742
security-tracker.debian.org/tracker/CVE-2026-16742
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3742
Show 17 moreShow less
suse.com/support/update/announcement/2026/suse-su-202623454-1
bugzilla.suse.com/1237515
ubuntu.com/security/CVE-2026-16742
cve.org/CVERecord?id=CVE-2026-16742
Left out here: 139 versions. The JSON record has them.