CVE-2026-40225

In udev in systemd before 260, local root execution can occur via malicious hardware devices and...

6.4 MediumFix available

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Attack profile

How easy it is to exploit

Attack vector: Physical
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.15%Up 0.1 points since Apr 11, 2026

What each source reports

CVE List Score used 6.4

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Record: CVE-2026-40225
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-669
Updated: 2026-11-02

EUVDEUVD-2026-21399 6.4

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Record: EUVD-2026-21399
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-396h-m3pm-fpm5 6.4

In udev in systemd before 260, local root execution can occur via malicious hardware devices and...

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Record: GHSA-396h-m3pm-fpm5
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-669
Updated: 2026-11-02

NVD 6.4

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Record: CVE-2026-40225
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-669
Updated: 2026-11-02

OSV 6.4

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Record: CVE-2026-40225
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-669
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-40225 6.4

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Record: DEBIAN-CVE-2026-40225
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 7 moreShow less

OSVOESA-2026-2548 6.4

systemd security update

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.(CVE-2026-40225)

Record: OESA-2026-2548
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:7299 7.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:7299
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2026-40225 6.4

CVE-2026-40225 in rootio-systemd - Patched by Root

Root has patched CVE-2026-40225 in the rootio-systemd package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2026-40225
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-13-CVE-2026-40225 6.4

CVE-2026-40225 in rootio-systemd - Patched by Root

Root has patched CVE-2026-40225 in the rootio-systemd package for Root:Debian:13. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-13-CVE-2026-40225
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-40225 6.4

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Record: UBUNTU-CVE-2026-40225
CVSS 3.1: 6.4 MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-84590 No score

CVE-2026-40225 affecting package systemd for versions less than 255-30

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Record: AZL-84590
Updated: 2026-11-05

OSVCLSA-2026-1787064068 No score

systemd: Fix of 2 CVEs

CVE-2026-40226: apply trusted-settings checks and normalize pivot root paths in systemd-nspawn
CVE-2026-40225: validate kernel-provided fields before emitting udev properties

Record: CLSA-2026-1787064068
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`systemd` Azure Linux:3	before 255-30	255-30
`systemd` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 252-14.el9_2.3.tuxcare.els4	252-14.el9_2.3.tuxcare.els4
`systemd-boot-unsigned` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 252-14.el9_2.3.tuxcare.els4	252-14.el9_2.3.tuxcare.els4
`systemd-container` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 252-14.el9_2.3.tuxcare.els4	252-14.el9_2.3.tuxcare.els4
`systemd-devel` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 252-14.el9_2.3.tuxcare.els4	252-14.el9_2.3.tuxcare.els4
`systemd-journal-remote` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 252-14.el9_2.3.tuxcare.els4	252-14.el9_2.3.tuxcare.els4
`systemd-libs` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 252-14.el9_2.3.tuxcare.els4	252-14.el9_2.3.tuxcare.els4
`systemd-oomd` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 252-14.el9_2.3.tuxcare.els4	252-14.el9_2.3.tuxcare.els4
`systemd-pam` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 252-14.el9_2.3.tuxcare.els4	252-14.el9_2.3.tuxcare.els4
`systemd-resolved` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 252-14.el9_2.3.tuxcare.els4	252-14.el9_2.3.tuxcare.els4

Show 36 moreShow less

Affected packages
Package	Affected	Fixed
`systemd-rpm-macros` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 252-14.el9_2.3.tuxcare.els4	252-14.el9_2.3.tuxcare.els4
`systemd-standalone-sysusers` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 252-14.el9_2.3.tuxcare.els4	252-14.el9_2.3.tuxcare.els4
`systemd-standalone-tmpfiles` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 252-14.el9_2.3.tuxcare.els4	252-14.el9_2.3.tuxcare.els4
`systemd-udev` TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs	before 252-14.el9_2.3.tuxcare.els4	252-14.el9_2.3.tuxcare.els4
`systemd` Debian:12	before 252.39-1~deb12u2, plus listed versions 252.11-1252.11-1~deb12u1252.12-1~deb12u1252.14-1~deb12u1252.16-1~deb12u1 Show 26 moreShow less 252.17-1~deb12u1252.18-1~deb12u1252.19-1~deb12u1252.20-1~deb12u1252.21-1~deb12u1252.22-1~deb12u1252.23-1~deb12u1252.24-1~deb12u1252.25-1~deb12u1252.26-1~deb12u1252.26-1~deb12u2252.26-1~deb12u2~bpo11+1252.27-1~deb12u1252.28-1~deb12u1252.29-1~deb12u1252.29-1~deb12u1~bpo11+1252.30-1~deb12u1252.30-1~deb12u2252.31-1~deb12u1252.32-1~deb12u1252.33-1~deb12u1252.36-1~deb12u1252.38-1~deb12u1252.39-1~deb12u1252.6-1252.6-1+loong64	252.39-1~deb12u2
`systemd` Debian:13	before 257.13-1~deb13u1, plus listed versions 257.7-1257.8-1~deb13u1257.8-1~deb13u2257.9-1~deb13u1	257.13-1~deb13u1
`systemd` Debian:14	before 260~rc4-1, plus listed versions 257.13-1~deb13u1257.7-1257.8-1~deb13u1257.8-1~deb13u2257.9-1~deb13u1 Show 17 moreShow less 258-1258.1-1258.1-2258~rc1-1258~rc2-1258~rc2-2258~rc3-1258~rc4-1259-1259.1-1259~rc1-1259~rc2-1259~rc3-1260~rc1-1260~rc1-2260~rc2-1260~rc3-1	260~rc4-1
`systemd` openEuler:22.03-LTS-SP4	before 249-115.oe2203sp4	249-115.oe2203sp4
`systemd` openEuler:24.03-LTS-SP1	before 255-59.oe2403sp1	255-59.oe2403sp1
`systemd` openEuler:24.03-LTS-SP3	before 255-59.oe2403sp3	255-59.oe2403sp3
`systemd` openEuler:20.03-LTS-SP4	before 243-91.oe2003sp4	243-91.oe2003sp4
`systemd` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-boot-unsigned` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-container` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-devel` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-journal-remote` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-libs` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-networkd` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-networkd-defaults` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-oomd-defaults` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-pam` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-resolved` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-rpm-macros` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-shared` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-standalone-repart` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-standalone-shutdown` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-standalone-sysusers` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-standalone-tmpfiles` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-sysusers` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-tests` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-udev` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd-ukify` Red Hat:hummingbird:1 From an advisory covering 8 CVEs	before 0:260.1-2.1.hum1	0:260.1-2.1.hum1
`systemd` Ubuntu:Pro:20.04:LTS	before 245.4-4ubuntu3.24+esm3, plus listed versions 242-7ubuntu3243-2ubuntu1243-3ubuntu1244-3ubuntu1244.1-0ubuntu2 Show 30 moreShow less 244.1-0ubuntu3244.2-1ubuntu1244.3-1ubuntu1245.2-1ubuntu1245.2-1ubuntu2245.4-2ubuntu1245.4-4ubuntu1245.4-4ubuntu3245.4-4ubuntu3.1245.4-4ubuntu3.2245.4-4ubuntu3.3245.4-4ubuntu3.4245.4-4ubuntu3.5245.4-4ubuntu3.6245.4-4ubuntu3.7245.4-4ubuntu3.10245.4-4ubuntu3.11245.4-4ubuntu3.13245.4-4ubuntu3.14245.4-4ubuntu3.15245.4-4ubuntu3.16245.4-4ubuntu3.17245.4-4ubuntu3.18245.4-4ubuntu3.19245.4-4ubuntu3.20245.4-4ubuntu3.21245.4-4ubuntu3.22245.4-4ubuntu3.23245.4-4ubuntu3.24245.4-4ubuntu3.24+esm1	245.4-4ubuntu3.24+esm3
`systemd` Ubuntu:22.04:LTS	before 249.11-0ubuntu3.19, plus listed versions 248.3-1ubuntu8249.5-2ubuntu1249.5-2ubuntu2249.5-2ubuntu3249.5-2ubuntu4 Show 18 moreShow less 249.9-0ubuntu2249.10-0ubuntu1249.10-0ubuntu2249.11-0ubuntu1249.11-0ubuntu2249.11-0ubuntu3249.11-0ubuntu3.1249.11-0ubuntu3.3249.11-0ubuntu3.4249.11-0ubuntu3.6249.11-0ubuntu3.7249.11-0ubuntu3.9249.11-0ubuntu3.10249.11-0ubuntu3.11249.11-0ubuntu3.12249.11-0ubuntu3.15249.11-0ubuntu3.16249.11-0ubuntu3.17	249.11-0ubuntu3.19
`systemd` Ubuntu:24.04:LTS	before 255.4-1ubuntu8.14, plus listed versions 253.5-1ubuntu6253.5-1ubuntu7255.2-3ubuntu2255.4-1ubuntu5255.4-1ubuntu6 Show 11 moreShow less 255.4-1ubuntu7255.4-1ubuntu8255.4-1ubuntu8.1255.4-1ubuntu8.2255.4-1ubuntu8.4255.4-1ubuntu8.5255.4-1ubuntu8.6255.4-1ubuntu8.8255.4-1ubuntu8.10255.4-1ubuntu8.11255.4-1ubuntu8.12	255.4-1ubuntu8.14
`systemd` Ubuntu:25.10	before 257.9-0ubuntu2.3, plus listed versions 257.4-1ubuntu3257.6-1ubuntu1257.7-1ubuntu1257.7-1ubuntu3257.8-0ubuntu2257.9-0ubuntu1257.9-0ubuntu2257.9-0ubuntu2.1	257.9-0ubuntu2.3

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	facts	OSV
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40225 is a medium vulnerability (CVSS 6.4) in Systemd, published April 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in systemd 255-30.

References

Show 56 moreShow less