CVE-2026-40223
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes...
4.7 MediumFix available
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
0.09%Up 0.1 points since Apr 11, 2026
What each source reports
CVE List Score used
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.
- Record
CVE-2026-40223- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-696
- Updated
- 2026-11-02
EUVDEUVD-2026-21394
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.
- Record
EUVD-2026-21394- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-52rm-r39v-fwv9
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes...
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.
- Record
GHSA-52rm-r39v-fwv9- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-696
- Updated
- 2026-11-02
NVD
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.
- Record
CVE-2026-40223- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-696
- Updated
- 2026-11-02
OSV
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.
- Record
CVE-2026-40223- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-696
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-40223
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.
- Record
DEBIAN-CVE-2026-40223- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:7299
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:7299- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-40223
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.
- Record
UBUNTU-CVE-2026-40223- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
systemdDebian:14 |
before 260~rc1-1, plus listed versions 257.13-1~deb13u1257.7-1257.8-1~deb13u1257.8-1~deb13u2257.9-1~deb13u1 Show 13 moreShow less258-1258.1-1258.1-2258~rc1-1258~rc2-1258~rc2-2258~rc3-1258~rc4-1259-1259.1-1259~rc1-1259~rc2-1259~rc3-1 |
260~rc1-1 |
systemdRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-boot-unsignedRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-containerRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-develRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-journal-remoteRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-libsRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-networkdRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-networkd-defaultsRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-oomd-defaultsRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
systemd-pamRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-resolvedRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-rpm-macrosRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-sharedRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-standalone-repartRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-standalone-shutdownRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-standalone-sysusersRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-standalone-tmpfilesRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-sysusersRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-testsRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-udevRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
systemd-ukifyRed Hat:hummingbird:1 From an advisory covering 8 CVEs |
before 0:260.1-2.1.hum1 | 0:260.1-2.1.hum1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40223 is a medium vulnerability (CVSS 4.7) in Systemd, published April 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.09%, the 0th percentile. Fixed in systemd 260~rc1-1.
References
github.com/systemd/systemd/security/advisories/GHSA-x4h8-rrrg-q78f
nvd.nist.gov/vuln/detail/CVE-2026-40223
security-tracker.debian.org/tracker/CVE-2026-40223
access.redhat.com/errata/RHSA-2026:7299
Show 52 moreShow less
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7299.json
bugzilla.redhat.com/show_bug.cgi?id=2447262
cve.org/CVERecord?id=CVE-2026-4105
openwall.com/lists/oss-security/2026/04/08/1
ubuntu.com/security/CVE-2026-40223