Input Validation Flaw in systemd Affects Multiple Releases
CVE-2026-40227

6.2MEDIUM

Key Information:

Vendor

Systemd

Status
Systemd
Vendor
CVE Published:
10 April 2026

What is CVE-2026-40227?

In versions of systemd prior to 261, a vulnerability exists that allows an unprivileged local user to trigger an assertion failure through a problematic IPC API call. This occurs when an array or map with a null element is used, potentially resulting in unexpected behavior or service interruption for the systemd service.

Affected Version(s)

systemd 260 < 261

References

https://github.com/systemd/systemd/security/advisories/GH...

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.