CVE-2026-29111

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-29111
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a Patch
https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6 Patch
https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412 Patch
https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd Patch
https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f Patch
https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f Patch
https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69 Patch
https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6 Patch
https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c Patch
https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8 Patch
https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
History

15 Apr 2026, 16:44

Type Values Removed Values Added
Summary
  • (es) systemd, un gestor de sistemas y servicios, (como PID 1) activa una aserción y congela la ejecución cuando se realiza una llamada a la API IPC no privilegiada con datos espurios. En la versión v249 y anteriores, el efecto no es una aserción, sino una sobrescritura de pila, con contenido controlado por el atacante. A partir de la versión v250 y posteriores, esto no es posible ya que la comprobación de seguridad provoca una aserción en su lugar. Esta llamada IPC se añadió en v239, por lo que las versiones anteriores a esa no están afectadas. Las versiones 260-rc1, 259.2, 258.5 y 257.11 contienen parches. No se conocen soluciones alternativas disponibles.
CPE cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*
References () https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a - () https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a - Patch
References () https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6 - () https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6 - Patch
References () https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412 - () https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412 - Patch
References () https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd - () https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd - Patch
References () https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f - () https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f - Patch
References () https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f - () https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f - Patch
References () https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69 - () https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69 - Patch
References () https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6 - () https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6 - Patch
References () https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c - () https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c - Patch
References () https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8 - () https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8 - Patch
References () https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764 - () https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764 - Patch, Vendor Advisory
First Time Systemd Project systemd
Systemd Project
CWE NVD-CWE-noinfo

23 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-23 22:16

Updated : 2026-04-15 16:44

NVD link : CVE-2026-29111

Mitre link : CVE-2026-29111

CVE.ORG link : CVE-2026-29111

JSON object : View

Products Affected

systemd_project

  • systemd
CWE
CWE-269

Improper Privilege Management

NVD-CWE-noinfo