systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

photon_os PHSA-2026-4.0-0998: Unknown PhotonOS Security Updated

photon_os PHSA-2026-5.0-0819: Unknown PhotonOS Security Updated

An update of the systemd package has been released.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20471-1 advisory.

    Update to systemd v257.13:

    Security issues:

    - CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method     (bsc#1259650).
    - CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
    - udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).

    Non security issues:

    - Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
    - Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
    - terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

    Changelog:

    - 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
    - 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
    - 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
    - fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

    For a complete list of changes, visit:
     https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b78     84c2610647e92806d14b28

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1061-1 advisory.

    - CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method     (bsc#1259650).
    - CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
    - udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

    Changelog:

    - 6a38d88a42 machined: reject invalid class types when registering machines
    - 8c9a592e5a udev: fix review mixup
    - b57007a917 udev-builtin-net-id: print cescaped bad attributes
    - ee23c7604b udev-builtin-net_id: do not assume the current interface name is ethX
    - 0f63e799e6 udev: ensure tag parsing stays within bounds
    - 046f52ec12 udev: ensure there is space for trailing NUL before calling sprintf
    - 5be21460ce udev: check for invalid chars in various fields received from the kernel
    - 9559607b16 core/cgroup: avoid one unnecessary strjoina()
    - fcae348ca4 core: validate input cgroup path more prudently
    - a3ca6b3031 alloc-util: add strdupa_safe() + strndupa_safe() and use it everywhere
    - 08125d6b06 units: add dep on systemd-logind.service by user@.service

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1040-1 advisory.

    - CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method     (bsc#1259650).
    - CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
    - udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

    Changelog:

    - a943e3ce2f machined: reject invalid class types when registering machines
    - 71593f77db udev: fix review mixup
    - 73a89810b4 udev-builtin-net-id: print cescaped bad attributes
    - 0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
    - 40905232e2 udev: ensure tag parsing stays within bounds
    - 7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
    - d018ac1ea3 udev: check for invalid chars in various fields received from the kernel
    - aef6e11921 core/cgroup: avoid one unnecessary strjoina()
    - cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
    - 26a748f727 core: validate input cgroup path more prudently
    - 99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8119-1 advisory.

    It was discovered that systemd incorrectly handled certain cgroup paths. A local attacker could possibly     use this issue to cause systemd to crash, resulting in a denial of service. (CVE-2026-29111)

    It was discovered that the systemd udev component incorrectly handled certain fields received from the     kernel. An attacker with a malicious device could possibly use this issue to execute arbitrary code as an     administrator (root).

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an     unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an     assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is     not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions     older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known     workarounds are available. (CVE-2026-29111)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
306342	Photon OS 5.0: Systemd PHSA-2026-5.0-0819	Nessus	PhotonOS Local Security Checks	medium
305859	openSUSE 16 Security Update : systemd (openSUSE-SU-2026:20471-1)	Nessus	SuSE Local Security Checks	medium
303956	SUSE SLES15 Security Update : systemd (SUSE-SU-2026:1061-1)	Nessus	SuSE Local Security Checks	medium
303939	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : systemd (SUSE-SU-2026:1040-1)	Nessus	SuSE Local Security Checks	medium
303747	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : systemd vulnerabilities (USN-8119-1)	Nessus	Ubuntu Local Security Checks	medium
303456	Linux Distros Unpatched Vulnerability : CVE-2026-29111	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-29111

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium