Skip to content
OpenAdvisories
Medium · 5.5 CVE-2026-29111 EUVD-2026-14562

systemd: Local unprivileged user can trigger an assert

Published Mar 23, 2026 · Updated Mar 25, 2026 · Assigned by GitHub_M

Vendor: systemd Product: systemd Package: systemd Package: systemd Package: systemd Package: systemd-bootstrap Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

Affected products

VendorProductAffectedFixed
systemd systemd >= 239, < 257.11, >= 258, < 258.5, >= 259, < 259.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 systemd 260~rc2-1 —
Debian 13 systemd 257.13-1~deb13u1 —
Debian 12 systemd 252.39-1~deb12u2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 systemd 257.9-0ubuntu2.3 USN-8119-1
Ubuntu 24.04 LTS systemd 255.4-1ubuntu8.14 USN-8119-1
Ubuntu 22.04 LTS systemd 249.11-0ubuntu3.19 USN-8119-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS systemd 245.4-4ubuntu3.24+esm3 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 systemd +11 257-13.el10_1.3 RHSA-2026:19068, RHSA-2026:13651
RHEL 9 systemd +12 252-55.el9_7.9 RHSA-2026:19213, RHSA-2026:13677
Show 11 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS systemd +11 257-9.el10_0.2 RHSA-2026:25900
RHEL 9.6 EUS systemd +12 252-51.el9_6.6 RHSA-2026:49910
RHEL 9.4 E4S systemd +10 252-32.el9_4.11 RHSA-2026:51134
RHEL 9.2 E4S systemd +10 252-14.el9_2.11 RHSA-2026:51277
RHEL 8.8 TUS systemd +7 239-74.el8_8.7 RHSA-2026:50050
RHEL 8.8 E4S systemd +7 239-74.el8_8.7 RHSA-2026:50050
RHEL 8.6 EUS Long Life systemd +7 239-58.el8_6.16 RHSA-2026:50077
RHEL 8.6 AUS systemd +7 239-58.el8_6.16 RHSA-2026:50077
RHEL 8.4 EUS Long Life systemd +7 239-45.el8_4.17 RHSA-2026:50051
RHEL 8.4 AUS systemd +7 239-45.el8_4.17 RHSA-2026:50051
Red Hat Hardened Images 1 systemd +20 260.1-2.1.hum1 RHSA-2026:7299

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 systemd +9 257-23.el10_2.1.alma.1 ALSA-2026:19068
AlmaLinux 10 systemd-ukify +1 257-13.el10_1.3.alma.1 ALSA-2026:19068, ALSA-2026:13651
AlmaLinux 9 systemd +12 252-55.el9_7.9.alma.1 ALSA-2026:19213, ALSA-2026:13677

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 systemd 257-13.el10_1.3.rocky.0.1 RLSA-2026:19068, RLSA-2026:13651
Rocky Linux 9 systemd 252-55.el9_7.9.rocky.0.1 RLSA-2026:19213, RLSA-2026:13677

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 systemd 254.27-150600.4.62.1 SUSE-SU-2026:1040-1
SLES 15 SP6 systemd 254.27-150600.4.62.1 SUSE-SU-2026:1040-1
SLES 15 SP5 systemd 249.17-150400.8.55.1 SUSE-SU-2026:1061-1
SLES 15 SP4 systemd 249.17-150400.8.55.1 SUSE-SU-2026:1061-1
Show 14 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 systemd 257.13-160000.1.1 SUSE-SU-2026:23620-1, SUSE-SU-2026:21144-1
SLES for SAP 15 SP6 systemd 254.27-150600.4.62.1 SUSE-SU-2026:1040-1
SLES for SAP 15 SP5 systemd 249.17-150400.8.55.1 SUSE-SU-2026:1061-1
SLES for SAP 15 SP4 systemd 249.17-150400.8.55.1 SUSE-SU-2026:1061-1
SLES 16.0 systemd 257.13-160000.1.1 SUSE-SU-2026:23620-1, SUSE-SU-2026:21144-1
SLE Micro 6.2 systemd 257.13-160000.1.1 SUSE-SU-2026:23470-1, SUSE-SU-2026:23454-1, SUSE-SU-2026:21003-1
SLE Micro 6.1 systemd 254.27-slfo.1.1_4.1 SUSE-SU-2026:20826-1
SLE Micro 6.0 systemd 254.27-3.1 SUSE-SU-2026:20822-1
SLE Micro 5.5 systemd 249.17-150400.8.55.1 SUSE-SU-2026:1061-1
SLE Micro 5.4 systemd 249.17-150400.8.55.1 SUSE-SU-2026:1061-1
SLE Micro 5.3 systemd 249.17-150400.8.55.1 SUSE-SU-2026:1061-1
SLE Micro 5.2 systemd 246.16-150300.7.65.1 SUSE-SU-2026:0990-1
SLE HPC 15 SP5 systemd 249.17-150400.8.55.1 SUSE-SU-2026:1061-1
SLE HPC 15 SP4 systemd 249.17-150400.8.55.1 SUSE-SU-2026:1061-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed systemd 259.5-1.3 openSUSE-SU-2026:10624-1
openSUSE Leap 16.0 systemd 257.13-160000.1.1 openSUSE-SU-2026:21754-1, openSUSE-SU-2026:20471-1
openSUSE Leap 16.0 systemd-mini 257.13-160000.4.1 openSUSE-SU-2026:21754-1
openSUSE Leap 15.6 systemd 254.27-150600.4.62.1 SUSE-SU-2026:1040-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 systemd 255-26 —
Azure Linux 3 systemd-bootstrap 250.3-19 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 systemd +11 257-13.0.1.el10_1.3 ELSA-2026-19068, ELSA-2026-13651
Oracle Linux 9 systemd +12 252-55.0.3.el9_7.9 ELSA-2026-19213, ELSA-2026-13677

Advisories 40

References