CVE-2026-15059

What it actually does

A local unprivileged user can exploit a missing path traversal validation in the systemd-oomd IPC API to terminate arbitrary local processes.

Why it matters to the business

Attackers with local access can disrupt critical system services and processes, leading to denial of service and potential system instability without requiring elevated privileges.

How an attack unfolds

An attacker with local unprivileged access crafts malicious IPC requests to the systemd-oomd service, using path traversal to specify arbitrary process paths and force their termination.

How to fix it

Apply patches to systemd-oomd to implement proper path validation in the IPC API. Monitor for updates from distribution maintainers.

How to confirm the fix worked

Verify the systemd-oomd version is updated to include path traversal fixes and test that unprivileged users cannot terminate arbitrary processes via the API.

Typical attack path

1. Obtain local unprivileged access to the system
2. Identify the systemd-oomd IPC endpoint
3. Craft and send path traversal payloads via the API to target processes
4. Terminate selected processes to disrupt operations

How to detect it

Review system logs for IPC calls to systemd-oomd from unprivileged users and unexpected process terminations. Check audit logs for suspicious activity involving oomd.

What your security team should do

• Prioritize patching systemd packages on all affected systems
• Implement least privilege access controls for local users
• Monitor system logs for unusual process terminations