# CVE-2026-40227: systemd denial of service via malformed IPC API call

Source: https://junglewise.ai/threats/cve-2026-40227-systemd-denial-of-service-via-malformed-ipc-api-call  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40227 · Severity: medium · CVSS 6.2 · Published 2026-04-10

systemd is a core system component for Linux operating systems that manages services and system processes. A vulnerability in version 260 allows a local user to crash the system's primary process (PID 1), leading to a complete system freeze. This results in a total loss of system availability, requiring a hard reboot to recover.

Technologies: [Systemd Project Systemd](https://junglewise.ai/threats/technologies/systemd). Vendors: [Systemd Project](https://junglewise.ai/threats/vendors/systemd-project).

## Quick answers

**Is CVE-2026-40227 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40227 being exploited in the wild.

**How severe is CVE-2026-40227?** Medium severity, with a CVSS score of 6.2, published 10 April 2026.

**Which products and versions are affected?** systemd project systemd 260.

**Is there a fix for CVE-2026-40227?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40227 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-40227?** Check whether you run Systemd Project Systemd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in systemd version 260 where the core manager (PID 1) fails to properly handle specific Varlink IPC API calls. By sending a request to the /run/systemd/io.systemd.Manager socket containing an array or map with a null element, an attacker triggers an assertion failure. Because this occurs in PID 1, the entire operating system execution freezes. The issue was introduced in version 260 and is resolved in versions 260.1 and 261. A temporary workaround involves restricting access to the affected Varlink socket to root users only.

## Affected products

- systemd project systemd 260

## Timeline

- 2026-03-23: advisory: Vendor advisory published on GitHub
- 2026-04-10: disclosed: CVE-2026-40227 assigned and published
- 2026-04-14: other: NIST initial analysis completed

## References

- [https://github.com/systemd/systemd/security/advisories/GHSA-848h-497j-8vjq](https://github.com/systemd/systemd/security/advisories/GHSA-848h-497j-8vjq)

## Related threats

- [systemd systemd-journald ANSI escape sequence injection in wall messages](https://junglewise.ai/threats/cve-2026-40228-systemd-systemd-journald-ansi-escape-sequence-injection-in-wall)
- [systemd systemd-machined local privilege escalation via Varlink](https://junglewise.ai/threats/cve-2026-40224-systemd-systemd-machined-local-privilege-escalation-via-varlink)
- [systemd denial of service via assertion failure in system units](https://junglewise.ai/threats/cve-2026-40223-systemd-denial-of-service-via-assertion-failure-in-system-units)
- [systemd privilege escalation via world-writable SUID files in timers](https://junglewise.ai/threats/cve-2016-10156-systemd-privilege-escalation-via-world-writable-suid-files-in)