CVE-2026-40224
Medium · 6.7CVSS
6.7
EPSS
0.1%
Published
Apr 10, 2026
CISA due date
—
The record
In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | systemd | 0 | 260.1-2.1 |
Related vulnerabilities
- CVE-2026-29111 systemd, a system and service manager, (as PID 1) hits an assert and freezes execution… Also affects systemd
- CVE-2026-4105 A flaw was found in systemd. Also affects systemd
- CVE-2019-6454 An issue was discovered in sd-bus in systemd 239. Also affects systemd
- CVE-2017-15908 In systemd 223 through 235, a remote DNS server can respond with a custom crafted DNS… Also affects systemd
- CVE-2017-9445 In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can… Also affects systemd
- CVE-2026-96398 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96384 Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful… CWE-863
- CVE-2026-96370 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request… CWE-863