CVE-2026-29111

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.(CVE-2026-29111)

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.(CVE-2026-4105)

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.(CVE-2026-29111)

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.(CVE-2026-4105)

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.(CVE-2026-29111)

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.(CVE-2026-4105)

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.(CVE-2026-29111)

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.(CVE-2026-29111)

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-29111 in the rootio-systemd package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-29111 in the rootio-systemd package for Root:Debian:13. Multiple fixed versions available.

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.

Security Fix(es):

• systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

• CVE-2026-29111: validate input cgroup path in GetUnitByControlGroup to prevent PID 1 assert/freeze on spurious IPC API calls
• CVE-2026-4105: reject invalid class types when registering machines in systemd-machined to prevent privilege escalation

• SECURITY UPDATE: stack overwriting via crafted cgroup path
  • debian/patches/CVE-2026-29111.patch: validate input cgroup path in method_get_unit_by_control_group with path_is_absolute() and path_is_normalized() checks before passing to manager_get_unit_by_cgroup().
  • CVE-2026-29111

• CVE-2026-29111: core: validate input cgroup path more prudently

• CVE-2026-29111: validate the control group path in the GetUnitByControlGroup D-Bus method, rejecting non-absolute or non-normalized input to prevent stack exhaustion from an oversized, attacker-controlled string
• Skip the test-fs-util symlink touch_file check when the build kernel does not support chmod() on a symlink (-EOPNOTSUPP), so the build's test phase no longer aborts during the package build

• CVE-2026-29111: validate the control group path in the GetUnitByControlGroup D-Bus method, rejecting non-absolute or non-normalized input to prevent stack exhaustion from an oversized, attacker-controlled string
• Skip the test-fs-util symlink touch_file check when the build kernel does not support chmod() on a symlink (-EOPNOTSUPP), so the build's test phase no longer aborts during the package build

• CVE-2026-29111: validate the control group path in the GetUnitByControlGroup D-Bus method, rejecting non-absolute or non-normalized input to prevent stack exhaustion from an oversized, attacker-controlled string
• Skip the test-fs-util symlink touch_file check when the build kernel does not support chmod() on a symlink (-EOPNOTSUPP), so the build's test phase no longer aborts during the package build

• CVE-2026-29111: validate the GetUnitByControlGroup cgroup path
  • debian/patches/CVE-2026-29111.patch: an unprivileged D-Bus caller could hand PID 1 a cgroup path that is neither absolute nor normalized via the GetUnitByControlGroup method, which on v249 and older overwrites stack memory with attacker-controlled content. Validate with path_is_absolute() and path_is_normalized() before manager_get_unit_by_cgroup().
• test: skip the meson suite on armel
  • debian/rules: the debian10-els armel worker runs under qemu-user (TCG) rather than native ARM hardware, so nine tests abort and two time out on interfaces qemu does not emulate (raw clone(), PR_SET_MM_ARG_*, SO_ATTACH_FILTER, netlink, netns, SIGBUS), and test-capability crashes the emulator itself. None of it is reachable from the package source. The full suite still runs on amd64 and arm64.
• test: fix two test failures on the current build nodes
  • debian/patches/test-seccomp-accept-ENOSYS-from-sysctl-2-too.patch: _sysctl(2) was removed from the kernel and now fails with ENOSYS rather than EFAULT, so test_protect_sysctl() aborted (upstream commit 0af05e485a3a).
  • debian/patches/fs-util-do-not-chmod-symlinks-in-touch_file.patch: touch_file() chmod()ed symlinks through /proc/self/fd, which newer kernels reject, so test_touch_file() aborted. Skip the chmod() for symlinks as upstream does in fchmod_and_chown(), and drop the now meaningless mode assertion from the test.

These are all security issues fixed in the libsystemd0-259.5-1.3 package on the GA media of openSUSE Tumbleweed.

This update for systemd fixes the following issues:

Update to systemd v257.13:

Security issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).

Non security issues:

• Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
• Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
• terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

Changelog:

• 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
• 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
• 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
• fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b7884c2610647e92806d14b28

This update for systemd fixes the following issue:

Security issue fixed:

• CVE-2026-16742: systemd-homed: local privilege escalation due to missing home record signature verification on the authentication path (bsc#1271444).

Non security issue fixed:

• systemd-resolved fails to start due to write access to tmpfs denied (bsc#1237515).

This update for systemd fixes the following issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

Changelog:

• 566517ffcb machined: reject invalid class types when registering machines
• abbdd89d78 udev: fix review mixup
• c9cedd26be udev-builtin-net-id: print cescaped bad attributes
• c0f4ec3db9 udev: ensure tag parsing stays within bounds
• 38afcb73cc udev: ensure there is space for trailing NUL before calling sprintf
• a64247de62 udev: check for invalid chars in various fields received from the kernel
• ecce32966e core/cgroup: avoid one unnecessary strjoina()
• 6abd2b5bd2 core: validate input cgroup path more prudently
• 2d7d93d6c1 alloc-util: add strdupa_safe() + strndupa_safe() and use it everywhere

This update for systemd fixes the following issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

Changelog:

• a943e3ce2f machined: reject invalid class types when registering machines
• 71593f77db udev: fix review mixup
• 73a89810b4 udev-builtin-net-id: print cescaped bad attributes
• 0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
• 40905232e2 udev: ensure tag parsing stays within bounds
• 7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
• d018ac1ea3 udev: check for invalid chars in various fields received from the kernel
• aef6e11921 core/cgroup: avoid one unnecessary strjoina()
• cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
• 26a748f727 core: validate input cgroup path more prudently
• 99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs

This update for systemd fixes the following issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

Changelog:

• 6a38d88a42 machined: reject invalid class types when registering machines
• 8c9a592e5a udev: fix review mixup
• b57007a917 udev-builtin-net-id: print cescaped bad attributes
• ee23c7604b udev-builtin-net_id: do not assume the current interface name is ethX
• 0f63e799e6 udev: ensure tag parsing stays within bounds
• 046f52ec12 udev: ensure there is space for trailing NUL before calling sprintf
• 5be21460ce udev: check for invalid chars in various fields received from the kernel
• 9559607b16 core/cgroup: avoid one unnecessary strjoina()
• fcae348ca4 core: validate input cgroup path more prudently
• a3ca6b3031 alloc-util: add strdupa_safe() + strndupa_safe() and use it everywhere
• 08125d6b06 units: add dep on systemd-logind.service by [email protected]

This update for systemd fixes the following issues:

Security issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

Non security issues:

• Name libsystemd-{shared,core} based on the major version of systemd and the package release number (bsc#1228081, bsc#1256427)
• detect-virt: bare-metal GCE only for x86 and i386 (bsc#1254293)

Changelog:

• a943e3ce2f machined: reject invalid class types when registering machines
• 71593f77db udev: fix review mixup
• 73a89810b4 udev-builtin-net-id: print cescaped bad attributes
• 0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
• 40905232e2 udev: ensure tag parsing stays within bounds
• 7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
• d018ac1ea3 udev: check for invalid chars in various fields received from the kernel
• aef6e11921 core/cgroup: avoid one unnecessary strjoina()
• cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
• 26a748f727 core: validate input cgroup path more prudently
• 99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs
• 8bbac1d508 detect-virt: bare-metal GCE only for x86 and i386

This update for systemd fixes the following issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

Changelog:

• a943e3ce2f machined: reject invalid class types when registering machines
• 71593f77db udev: fix review mixup
• 73a89810b4 udev-builtin-net-id: print cescaped bad attributes
• 0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
• 40905232e2 udev: ensure tag parsing stays within bounds
• 7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
• d018ac1ea3 udev: check for invalid chars in various fields received from the kernel
• aef6e11921 core/cgroup: avoid one unnecessary strjoina()
• cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
• 26a748f727 core: validate input cgroup path more prudently
• 99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs

This update for systemd fixes the following issues:

Update to systemd v257.13:

Security issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).

Non security issues:

• Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
• Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
• terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

Changelog:

• 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
• 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
• 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
• fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b7884c2610647e92806d14b28

This update for systemd fixes the following issues:

Update to systemd v257.13:

Security issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).

Non security issues:

• Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
• Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
• terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

Changelog:

• 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
• 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
• 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
• fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b7884c2610647e92806d14b28