Executive brief
A security vulnerability in systemd-machined, a service used to manage virtual machines and containers, allows a standard user logged into a desktop session to gain full administrative (root) control of the system. This issue occurs when an attacker uses a specific communication protocol to bypass security boundaries and reach the core system namespace. An exploit could lead to a total compromise of the machine's data and operations, though it typically requires the attacker to have local access to a graphical desktop session.
Technical details
A local privilege escalation vulnerability exists in systemd-machined versions 259 through 259.2. The flaw is rooted in incorrect authorization (CWE-863) where Varlink IPC calls can be leveraged to reach the root namespace from an unprivileged context. To exploit this, an attacker must be an unprivileged user logged into a local desktop graphical session; remote sessions like SSH are reportedly unaffected. Successful exploitation allows the user to escalate privileges to root. The issue is addressed in systemd version 260 and backported to 259.3. A workaround involves implementing a Polkit rule to restrict 'org.freedesktop.machine1.register-machine' actions to administrative users.
Affected products
- systemd project systemd-machined 259 before 260, 259.3
Timeline
- 2026-03-04: advisory: Vendor advisory published on GitHub
- 2026-04-10: disclosed: CVE published to NVD
- 2026-04-27: other: NVD analysis and CPE enrichment completed