systemd vulnerabilities

CVEs per yearBy the year they were published

1. 20183
2. 20201
3. 202610

Newest CVEs

• CVE-2026-15060

  systemd-machined: unprivileged users can terminate arbitrary processes

  systemd · systemd-machined

  Medium4.7
• CVE-2026-16742

  systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path

  systemd · systemd-homed

  Medium6.7
• CVE-2026-15059

  systemd-oomd: unprivileged users can terminate arbitrary processes

  systemd · systemd-oomd

  Medium5.5
• CVE-2026-40228

  In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p emerg" command is executed, if…

  systemd · systemd

  Low2.9
• CVE-2026-40227

  In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.

  systemd · systemd

  Medium6.2
• CVE-2026-40226

  In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.

  systemd · systemd

  Medium6.4
• CVE-2026-40225

  In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

  systemd · systemd

  Medium6.4
• CVE-2026-40224

  In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.

  systemd · systemd

  Medium6.7
• CVE-2026-40223

  In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running.

  systemd · systemd

  Medium4.7
• CVE-2026-29111

  systemd: Local unprivileged user can trigger an assert

  systemd · systemd

  Medium5.5