OESA-2026-1910 (CVE-2026-29111)
Vulnerability from osv_openeuler – Published: 2026-04-17 11:10 – Updated: 2026-08-06 11:10 – Source websitesystemd is a system and service manager that runs as PID 1 and starts the rest of the system.
Security Fix(es):
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.(CVE-2026-29111)
A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.(CVE-2026-4105)
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"systemd-255-57.oe2403sp2.aarch64.rpm",
"systemd-container-255-57.oe2403sp2.aarch64.rpm",
"systemd-cryptsetup-255-57.oe2403sp2.aarch64.rpm",
"systemd-debuginfo-255-57.oe2403sp2.aarch64.rpm",
"systemd-debugsource-255-57.oe2403sp2.aarch64.rpm",
"systemd-devel-255-57.oe2403sp2.aarch64.rpm",
"systemd-libs-255-57.oe2403sp2.aarch64.rpm",
"systemd-networkd-255-57.oe2403sp2.aarch64.rpm",
"systemd-nspawn-255-57.oe2403sp2.aarch64.rpm",
"systemd-pam-255-57.oe2403sp2.aarch64.rpm",
"systemd-resolved-255-57.oe2403sp2.aarch64.rpm",
"systemd-timesyncd-255-57.oe2403sp2.aarch64.rpm",
"systemd-udev-255-57.oe2403sp2.aarch64.rpm"
],
"noarch": [
"systemd-help-255-57.oe2403sp2.noarch.rpm"
],
"src": [
"systemd-255-57.oe2403sp2.src.rpm"
],
"x86_64": [
"systemd-255-57.oe2403sp2.x86_64.rpm",
"systemd-container-255-57.oe2403sp2.x86_64.rpm",
"systemd-cryptsetup-255-57.oe2403sp2.x86_64.rpm",
"systemd-debuginfo-255-57.oe2403sp2.x86_64.rpm",
"systemd-debugsource-255-57.oe2403sp2.x86_64.rpm",
"systemd-devel-255-57.oe2403sp2.x86_64.rpm",
"systemd-libs-255-57.oe2403sp2.x86_64.rpm",
"systemd-networkd-255-57.oe2403sp2.x86_64.rpm",
"systemd-nspawn-255-57.oe2403sp2.x86_64.rpm",
"systemd-pam-255-57.oe2403sp2.x86_64.rpm",
"systemd-resolved-255-57.oe2403sp2.x86_64.rpm",
"systemd-timesyncd-255-57.oe2403sp2.x86_64.rpm",
"systemd-udev-255-57.oe2403sp2.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS-SP2",
"name": "systemd",
"purl": "pkg:rpm/openEuler/systemd\u0026distro=openEuler-24.03-LTS-SP2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "255-57.oe2403sp2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Medium"
},
"details": "systemd is a system and service manager that runs as PID 1 and starts the rest of the system.\r\n\r\nSecurity Fix(es):\n\nsystemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.(CVE-2026-29111)\n\nA flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.(CVE-2026-4105)",
"id": "OESA-2026-1910",
"modified": "2026-08-06T11:10:55Z",
"published": "2026-04-17T11:10:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1910"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4105"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "systemd security update",
"upstream": [
"CVE-2026-29111",
"CVE-2026-4105"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.