Executive brief
systemd is a core system component for Linux operating systems that manages services and system processes. A vulnerability in version 260 allows a local user to crash the system's primary process (PID 1), leading to a complete system freeze. This results in a total loss of system availability, requiring a hard reboot to recover.
Technical details
A vulnerability exists in systemd version 260 where the core manager (PID 1) fails to properly handle specific Varlink IPC API calls. By sending a request to the /run/systemd/io.systemd.Manager socket containing an array or map with a null element, an attacker triggers an assertion failure. Because this occurs in PID 1, the entire operating system execution freezes. The issue was introduced in version 260 and is resolved in versions 260.1 and 261. A temporary workaround involves restricting access to the affected Varlink socket to root users only.
Affected products
- systemd project systemd 260
Timeline
- 2026-03-23: advisory: Vendor advisory published on GitHub
- 2026-04-10: disclosed: CVE-2026-40227 assigned and published
- 2026-04-14: other: NIST initial analysis completed