CVE-2026-16742

What it actually does

Allows a local authenticated user managed by systemd-homed to add arbitrary system groups to their account, resulting in unintended privilege escalation on the host.

Why it matters to the business

Local attackers can obtain elevated system access, increasing risk of unauthorized data access, configuration changes, or further compromise of the affected system.

How an attack unfolds

An attacker with a valid local login to a homed-managed user account triggers the flaw during user session handling to inject privileged system groups such as wheel or sudo into the account, enabling execution of administrative commands.

How to fix it

Upgrade systemd-homed to a patched release from the distribution vendor as soon as one becomes available. Until then, avoid using homed-managed user accounts for interactive logins on multi-user systems.

How to confirm the fix worked

Confirm the installed systemd-homed package version matches or exceeds the vendor's fixed release. Test that group modification attempts by homed users are properly restricted in a lab environment.

Typical attack path

1. Obtain a local shell as a homed-managed user
2. Trigger the group assignment code path in systemd-homed
3. Inject arbitrary high-privilege system groups
4. Escalate to root-level actions via the newly granted group memberships

How to detect it

Inspect systemd-homed service logs and authentication logs for unexpected additions of system groups to homed user accounts; periodically audit /etc/group for entries added outside normal administrative processes.

What your security team should do

• Track distribution security advisories for the upcoming fix and schedule immediate deployment
• Limit interactive use of homed-managed accounts until patched
• Enable audit logging on group database changes to detect anomalous modifications