Executive brief
A vulnerability in systemd, the core system manager for many Linux distributions, allows a local user to crash the system's primary control process (PID 1). By sending a specific command to a running service configured with certain delegation settings, an attacker can cause the entire operating system to freeze. This results in a total loss of system availability, requiring a hard reboot to recover.
Technical details
An assertion failure exists in systemd versions 258 and 259 when handling IPC API calls for specific unit configurations. The vulnerability is triggered when a system unit is running with 'Delegate=yes' enabled and 'User=' unset (defaulting to root). A local unprivileged attacker can invoke the 'AttachProcesses' method via the D-Bus interface (org.freedesktop.systemd1) to trigger the assert. Because systemd runs as PID 1, hitting an assertion failure causes the process to freeze execution, effectively halting the entire operating system. The issue is addressed in systemd version 260 and backported to 259.2 and 258.5.
Affected products
- systemd project systemd 258, 259
Timeline
- 2026-03-23: advisory: Vendor advisory published on GitHub
- 2026-04-10: disclosed: CVE published to NVD