CVE-2026-4105

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.(CVE-2026-29111)

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.(CVE-2026-4105)

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.(CVE-2026-4105)

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.(CVE-2026-4105)

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.(CVE-2026-29111)

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.(CVE-2026-4105)

systemd is a system and service manager that runs as PID 1 and starts the rest of the system.

Security Fix(es):

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.(CVE-2026-29111)

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.(CVE-2026-4105)

Root has patched CVE-2026-4105 in the rootio-systemd package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-4105 in the rootio-systemd package for Root:Debian:13. Multiple fixed versions available.

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.

• CVE-2026-29111: validate input cgroup path in GetUnitByControlGroup to prevent PID 1 assert/freeze on spurious IPC API calls
• CVE-2026-4105: reject invalid class types when registering machines in systemd-machined to prevent privilege escalation

• CVE-2026-4105: machined: reject invalid class types when registering machines

These are all security issues fixed in the libsystemd0-259.5-1.3 package on the GA media of openSUSE Tumbleweed.

This update for systemd fixes the following issues:

Update to systemd v257.13:

Security issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).

Non security issues:

• Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
• Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
• terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

Changelog:

• 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
• 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
• 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
• fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b7884c2610647e92806d14b28

This update for systemd fixes the following issue:

Security issue fixed:

• CVE-2026-16742: systemd-homed: local privilege escalation due to missing home record signature verification on the authentication path (bsc#1271444).

Non security issue fixed:

• systemd-resolved fails to start due to write access to tmpfs denied (bsc#1237515).

This update for systemd fixes the following issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

Changelog:

• 566517ffcb machined: reject invalid class types when registering machines
• abbdd89d78 udev: fix review mixup
• c9cedd26be udev-builtin-net-id: print cescaped bad attributes
• c0f4ec3db9 udev: ensure tag parsing stays within bounds
• 38afcb73cc udev: ensure there is space for trailing NUL before calling sprintf
• a64247de62 udev: check for invalid chars in various fields received from the kernel
• ecce32966e core/cgroup: avoid one unnecessary strjoina()
• 6abd2b5bd2 core: validate input cgroup path more prudently
• 2d7d93d6c1 alloc-util: add strdupa_safe() + strndupa_safe() and use it everywhere

This update for systemd fixes the following issue:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

Changelog:

cbf8ee66ee machined: reject invalid class types when registering machines 1a55ad48da udev: fix review mixup 1eba76668c udev-builtin-net-id: print cescaped bad attributes cbd4b55380 udev: ensure tag parsing stays within bounds 5973d3b1cc udev: ensure there is space for trailing NUL before calling sprintf f038eb6c8b udev: check for invalid chars in various fields received from the kernel

This update for systemd fixes the following issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

Changelog:

• a943e3ce2f machined: reject invalid class types when registering machines
• 71593f77db udev: fix review mixup
• 73a89810b4 udev-builtin-net-id: print cescaped bad attributes
• 0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
• 40905232e2 udev: ensure tag parsing stays within bounds
• 7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
• d018ac1ea3 udev: check for invalid chars in various fields received from the kernel
• aef6e11921 core/cgroup: avoid one unnecessary strjoina()
• cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
• 26a748f727 core: validate input cgroup path more prudently
• 99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs

This update for systemd fixes the following issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

Changelog:

• 6a38d88a42 machined: reject invalid class types when registering machines
• 8c9a592e5a udev: fix review mixup
• b57007a917 udev-builtin-net-id: print cescaped bad attributes
• ee23c7604b udev-builtin-net_id: do not assume the current interface name is ethX
• 0f63e799e6 udev: ensure tag parsing stays within bounds
• 046f52ec12 udev: ensure there is space for trailing NUL before calling sprintf
• 5be21460ce udev: check for invalid chars in various fields received from the kernel
• 9559607b16 core/cgroup: avoid one unnecessary strjoina()
• fcae348ca4 core: validate input cgroup path more prudently
• a3ca6b3031 alloc-util: add strdupa_safe() + strndupa_safe() and use it everywhere
• 08125d6b06 units: add dep on systemd-logind.service by [email protected]

This update for systemd fixes the following issues:

Security issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

Non security issues:

• Name libsystemd-{shared,core} based on the major version of systemd and the package release number (bsc#1228081, bsc#1256427)
• detect-virt: bare-metal GCE only for x86 and i386 (bsc#1254293)

Changelog:

• a943e3ce2f machined: reject invalid class types when registering machines
• 71593f77db udev: fix review mixup
• 73a89810b4 udev-builtin-net-id: print cescaped bad attributes
• 0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
• 40905232e2 udev: ensure tag parsing stays within bounds
• 7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
• d018ac1ea3 udev: check for invalid chars in various fields received from the kernel
• aef6e11921 core/cgroup: avoid one unnecessary strjoina()
• cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
• 26a748f727 core: validate input cgroup path more prudently
• 99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs
• 8bbac1d508 detect-virt: bare-metal GCE only for x86 and i386

This update for systemd fixes the following issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

Changelog:

• a943e3ce2f machined: reject invalid class types when registering machines
• 71593f77db udev: fix review mixup
• 73a89810b4 udev-builtin-net-id: print cescaped bad attributes
• 0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
• 40905232e2 udev: ensure tag parsing stays within bounds
• 7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
• d018ac1ea3 udev: check for invalid chars in various fields received from the kernel
• aef6e11921 core/cgroup: avoid one unnecessary strjoina()
• cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
• 26a748f727 core: validate input cgroup path more prudently
• 99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs

This update for systemd fixes the following issues:

Update to systemd v257.13:

Security issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).

Non security issues:

• Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
• Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
• terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

Changelog:

• 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
• 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
• 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
• fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b7884c2610647e92806d14b28

This update for systemd fixes the following issues:

Update to systemd v257.13:

Security issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).

Non security issues:

• Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
• Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
• terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

Changelog:

• 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
• 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
• 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
• fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b7884c2610647e92806d14b28

This update for systemd fixes the following issues:

Update to systemd v257.13:

Security issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).

Non security issues:

• Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
• Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
• terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

Changelog:

• 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
• 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
• 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
• fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b7884c2610647e92806d14b28

This update for systemd fixes the following issue:

Security issue fixed:

• CVE-2026-16742: systemd-homed: local privilege escalation due to missing home record signature verification on the authentication path (bsc#1271444).

Non security issue fixed:

• systemd-resolved fails to start due to write access to tmpfs denied (bsc#1237515).

This update for systemd fixes the following issue:

Security issue fixed:

• CVE-2026-16742: systemd-homed: local privilege escalation due to missing home record signature verification on the authentication path (bsc#1271444).

Non security issue fixed:

• systemd-resolved fails to start due to write access to tmpfs denied (bsc#1237515).

This update for systemd fixes the following issue:

Security issue fixed:

• CVE-2026-16742: systemd-homed: local privilege escalation due to missing home record signature verification on the authentication path (bsc#1271444).

Non security issue fixed:

• systemd-resolved fails to start due to write access to tmpfs denied (bsc#1237515).