# CVE-2025-4598: systemd systemd-coredump race condition in SUID crash handling

Source: https://junglewise.ai/threats/cve-2025-4598-systemd-systemd-coredump-race-condition-in-suid-crash-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-05-30. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2025-4598 · Severity: medium · CVSS 4.7 · Published 2025-05-30

A vulnerability in the systemd component responsible for handling program crashes could allow a local user to access sensitive information. By exploiting a timing issue during a crash, an attacker can trick the system into giving them access to the memory contents of a privileged process. This could result in the exposure of sensitive system files, such as password hashes, which are normally restricted to administrative users.

Technologies: [Debian Linux](https://junglewise.ai/threats/technologies/debian), [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [Debian](https://junglewise.ai/threats/vendors/debian), [Linux](https://junglewise.ai/threats/vendors/linux), [Red Hat](https://junglewise.ai/threats/vendors/red-hat), [Systemd Project](https://junglewise.ai/threats/vendors/systemd-project).

## Quick answers

**Is CVE-2025-4598 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-4598 being exploited in the wild.

**How severe is CVE-2025-4598?** Medium severity, with a CVSS score of 4.7, published 30 May 2025.

**Which products and versions are affected?** Debian Linux 11, 12, 11.0, 12.0; Linux Kernel up to (excluding) 6.16; Red Hat Enterprise Linux 9 systemd-252-55.el9_7.7; Systemd Project Systemd-Coredump up to (excluding) 252.37, 253 up to (excluding) 253.32, 254 up to (excluding) 254.25, 255 up to (excluding) 255.19, 256 up to (excluding) 256.14, 257 up to (excluding) 257.6.

**Is there a fix for CVE-2025-4598?** A patch was published on 2025-12-03: Red Hat Enterprise Linux 9 patch released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-4598 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2025-4598?** Check whether you run Debian Linux, Linux Kernel, Red Hat Enterprise Linux 9 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition exists in systemd-coredump during the handling of SUID process crashes. An attacker can force a SUID process to crash and then rapidly recycle the process ID (PID) by launching a non-privileged binary before systemd-coredump can verify the process metadata via /proc/pid/auxv. If the attacker wins this race, systemd-coredump may associate the privileged coredump with the attacker's new unprivileged process, granting them read access to the core file. This file contains the memory state of the original SUID process, which may include sensitive data like /etc/shadow contents. Patches have been released for various systemd versions and Linux distributions.

## Affected products

- systemd project systemd-coredump up to (excluding) 252.37, 253 up to (excluding) 253.32, 254 up to (excluding) 254.25, 255 up to (excluding) 255.19, 256 up to (excluding) 256.14, 257 up to (excluding) 257.6
- Red Hat Enterprise Linux 9 systemd-252-55.el9_7.7
- Debian Debian Linux 11.0, 12.0
- Linux Linux Kernel up to (excluding) 6.16

## Timeline

- 2025-05-29: disclosed: Initial disclosure by Red Hat
- 2025-05-30: advisory: NVD publication date
- 2025-12-03: patched: Red Hat Enterprise Linux 9 patch released

## References

- [https://access.redhat.com/errata/RHSA-2025:22660](https://access.redhat.com/errata/RHSA-2025:22660)
- [https://access.redhat.com/errata/RHSA-2025:22868](https://access.redhat.com/errata/RHSA-2025:22868)
- [https://access.redhat.com/errata/RHSA-2025:23227](https://access.redhat.com/errata/RHSA-2025:23227)
- [https://access.redhat.com/errata/RHSA-2025:23234](https://access.redhat.com/errata/RHSA-2025:23234)
- [https://access.redhat.com/errata/RHSA-2026:0414](https://access.redhat.com/errata/RHSA-2026:0414)
- [https://access.redhat.com/errata/RHSA-2026:1652](https://access.redhat.com/errata/RHSA-2026:1652)
- [https://access.redhat.com/errata/RHSA-2026:18153](https://access.redhat.com/errata/RHSA-2026:18153)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)