Summary
It was discovered that systemd-nspawn incorrectly handled certain optional
configuration files. A local attacker could possibly use this issue to
escape to the host system and execute arbitrary code. (CVE-2026-40226)
It was discovered that systemd-resolved incorrectly validated DNSSEC
records for signed domains. An attacker could possibly use this issue to
manipulate DNS records. This issue only affected Ubuntu 22.04 LTS.
(CVE-2023-7008)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | systemd | 249.11-0ubuntu3.21 |
| Ubuntu · 24.04 LTS 24.04:LTS | systemd | 255.4-1ubuntu8.16 |
| Ubuntu · 25.10 | systemd | 257.9-0ubuntu2.5 |
Vulnerabilities 2
-
Medium 6.4
In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.
-
Medium 5.9
Systemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes
A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.