# CVE-2026-40223: systemd denial of service via assertion failure in system units

Source: https://junglewise.ai/threats/cve-2026-40223-systemd-denial-of-service-via-assertion-failure-in-system-units  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40223 · Severity: medium · CVSS 4.7 · Published 2026-04-10

A vulnerability in systemd, the core system manager for many Linux distributions, allows a local user to crash the system's primary control process (PID 1). By sending a specific command to a running service configured with certain delegation settings, an attacker can cause the entire operating system to freeze. This results in a total loss of system availability, requiring a hard reboot to recover.

Technologies: [Systemd Project Systemd](https://junglewise.ai/threats/technologies/systemd). Vendors: [Systemd Project](https://junglewise.ai/threats/vendors/systemd-project).

## Quick answers

**Is CVE-2026-40223 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40223 being exploited in the wild.

**How severe is CVE-2026-40223?** Medium severity, with a CVSS score of 4.7, published 10 April 2026.

**Which products and versions are affected?** systemd project systemd 258, 259.

**Is there a fix for CVE-2026-40223?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40223 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-40223?** Check whether you run Systemd Project Systemd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An assertion failure exists in systemd versions 258 and 259 when handling IPC API calls for specific unit configurations. The vulnerability is triggered when a system unit is running with 'Delegate=yes' enabled and 'User=' unset (defaulting to root). A local unprivileged attacker can invoke the 'AttachProcesses' method via the D-Bus interface (org.freedesktop.systemd1) to trigger the assert. Because systemd runs as PID 1, hitting an assertion failure causes the process to freeze execution, effectively halting the entire operating system. The issue is addressed in systemd version 260 and backported to 259.2 and 258.5.

## Affected products

- systemd project systemd 258, 259

## Timeline

- 2026-03-23: advisory: Vendor advisory published on GitHub
- 2026-04-10: disclosed: CVE published to NVD

## References

- [https://github.com/systemd/systemd/security/advisories/GHSA-x4h8-rrrg-q78f](https://github.com/systemd/systemd/security/advisories/GHSA-x4h8-rrrg-q78f)

## Related threats

- [systemd systemd-journald ANSI escape sequence injection in wall messages](https://junglewise.ai/threats/cve-2026-40228-systemd-systemd-journald-ansi-escape-sequence-injection-in-wall)
- [systemd denial of service via malformed IPC API call](https://junglewise.ai/threats/cve-2026-40227-systemd-denial-of-service-via-malformed-ipc-api-call)
- [systemd systemd-machined local privilege escalation via Varlink](https://junglewise.ai/threats/cve-2026-40224-systemd-systemd-machined-local-privilege-escalation-via-varlink)
- [systemd privilege escalation via world-writable SUID files in timers](https://junglewise.ai/threats/cve-2016-10156-systemd-privilege-escalation-via-world-writable-suid-files-in)