Medium severity · published Mar 23, 2026
CVE-2026-29111
systemd: Local unprivileged user can trigger an assert
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
systemd · systemd
>= 239, < 257.11; >= 258, < 258.5; >= 259, < 259.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-29111
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-29111
Patch
https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a
Patch
https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6
Patch
https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412
Patch
https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd
Patch
https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f
Patch
https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f
More from systemd
7.3
CVE-2026-40224
In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace
6.4
CVE-2026-40226
In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file
6.4
CVE-2026-40225
In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output
5.5
CVE-2026-40227
In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element
5.5
CVE-2026-40223
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running