Executive brief
A vulnerability in the udev component of systemd allows an attacker with physical access to a computer to gain full administrative (root) control. By plugging in a specially crafted USB or SCSI device, the attacker can trick the system into executing malicious commands or starting unauthorized services. This could lead to a complete compromise of the machine's data and security.
Technical details
The udev helper binaries scsi_id and v4l_id fail to properly sanitize input received from the kernel, which is derived from hardware descriptors. An attacker can craft a malicious device (USB or SCSI) with properties containing newline characters and udev directives. For example, a crafted ID_V4L_PRODUCT can inject REMOVE_CMD to execute arbitrary binaries, while a crafted ID_SCSI_SERIAL can inject SYSTEMD_WANTS to trigger systemd units like debug-shell.service. This results in local root execution. The vulnerability is patched in systemd versions 260, 259.5, 258.7, and 257.13.
Affected products
- systemd project systemd udev < 260, < 259.5, < 258.7, < 257.13
Timeline
- 2026-03-23: advisory: GitHub advisory published by systemd project
- 2026-04-10: disclosed: CVE published to NVD
- 2026-04-27: other: NVD analysis and CPE enrichment