Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 21

Vulnerabilities 8

• Medium 6.7
  CVE-2026-40224

  In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach…

  systemd systemd systemd systemd Debian Wolfi
  Apr 10, 2026
• Medium 6.7
  CVE-2026-4105

  Systemd: systemd: privilege escalation via improper access control in registermachine d-bus method

  A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian
  Mar 13, 2026
• Medium 6.4
  CVE-2026-40225

  In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel out…

  systemd systemd systemd systemd Debian Ubuntu Azure Linux
  Apr 10, 2026
• Medium 6.4
  CVE-2026-40226

  In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.

  systemd systemd systemd systemd Debian Ubuntu Azure Linux
  Apr 10, 2026
• Medium 6.2
  CVE-2026-40227

  In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map tha…

  systemd systemd systemd Debian
  Apr 10, 2026
• Medium 5.5
  CVE-2026-29111

  systemd: Local unprivileged user can trigger an assert

  systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled con…

  systemd systemd systemd systemd Debian Ubuntu Azure Linux
  Mar 23, 2026
• Medium 4.7
  CVE-2026-40223

  In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit ex…

  systemd systemd systemd Debian
  Apr 10, 2026
• Low 2.9
  CVE-2026-40228

  In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p e…

  systemd systemd systemd systemd Debian Ubuntu
  Apr 10, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-40228
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-40226
• report
  https://access.redhat.com/security/cve/CVE-2026-40225
• report
  https://access.redhat.com/security/cve/CVE-2026-40224
• report
  https://access.redhat.com/security/cve/CVE-2026-40223
• report
  https://access.redhat.com/security/cve/CVE-2026-29111
• report
  https://access.redhat.com/security/cve/CVE-2026-40227
• report
  https://access.redhat.com/security/cve/CVE-2026-4105
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7299.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447262
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4105
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4105
• article
  https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2450505
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-29111
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-29111
• article
  https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a
• article
  https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6
• article
  https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412
• article
  https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd
• article
  https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f
• article
  https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f
• article
  https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69
• article
  https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6
• article
  https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c
• article
  https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8
• article
  https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457318
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-40223
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-40223
• article
  https://github.com/systemd/systemd/security/advisories/GHSA-x4h8-rrrg-q78f
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457325
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-40224
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-40224
• article
  https://github.com/systemd/systemd/security/advisories/GHSA-6pwp-j5vg-5j6m
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457324
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-40225