systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:13651 advisory.

    * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data     (CVE-2026-29111)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-13651 advisory.

    [257-13.0.1.el10_1.3]
    - Fix detection of Oracle Virtualization or BM envs [Orabug: 37531877]
    - Avoid udevadm warnings when using udev valid configs [Orabug: 37503197]
    - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469]
    - set 'RemoveIPC=no' in logind.conf as default [Orabug: 22224874]
    - Fix missing netdev for iscsi entry in fstab [Orabug: 25897792]
    - udev rules: fix memory hot add and remove [Orabug: 31310273]
    - Disable unprivileged BPF by default [Orabug: 32870980]
    - Remove upstream references [Orabug: 33995357]
    - Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407]
    - Removed unneeded patches from the systemd.spec
    - 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490]
    - 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490]
    - 1006-orabug34467234-shutdown-get-only-active-md-arrays.patch [Orabug: 34467234]
    - 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110]
    - 1008-path-drop-IN_ATTRIB-from-parent-directory-watches.patch [Orabug: 36780432]

    [257-13.3]
    - ci: re-enable bpf-framework option for build and unit test jobs (RHEL-155394)
    - ci: add bpftool workaround to codeql job too (RHEL-155394)
    - ci: fix workaround about bpftool for codeql (RHEL-155394)
    - ci: add bpftool workaround to coverity too (RHEL-155394)
    - ci: pin Packit/mkosi to the latest RHEL 10.1 commit (RHEL-155394)
    - ci: run apt-get update before running mkosi (RHEL-155394)
    - path-util: add flavour of path_startswith() that leaves a leading slash in place (RHEL-155394)
    - cgroup: port some code over to path_startswith_full() (RHEL-155394)
    - path-util: invert PATH_STARTSWITH_ACCEPT_DOT_DOT flag (RHEL-155394)
    - sd-json: fix off-by-one issue when updating parent for array elements (RHEL-155394)
    - core/cgroup: avoid one unnecessary strjoina() (RHEL-155394)
    - core: validate input cgroup path more prudently (RHEL-155394)

    [257-13.2]
    - Revert 'coredump: fix 0-passed-as-pointer warning' (RHEL-104135)
    - Revert 'Define helper to call PR_SET_DUMPABLE' (RHEL-104135)
    - Revert 'coredump: introduce an enum to wrap dumpable constants' (RHEL-104135)
    - Revert 'coredump: when %F/pidfd is used, again allow forwarding to containers' (RHEL-104135)
    - Revert 'coredump: add support for new %F PIDFD specifier' (RHEL-104135)
    - Revert 'coredump: get rid of a bogus assertion' (RHEL-104135)
    - Revert 'coredump: also stop forwarding non-dumpable processes' (RHEL-104135)
    - Revert 'coredump: use %d in kernel core pattern' (RHEL-104135)
    - Revert 'coredump: get rid of _META_MANDATORY_MAX' (RHEL-104135)
    - Revert 'coredump: wrap long lines, fix grammar in comments' (RHEL-104135)
    - Revert 'coredump: restore compatibility with older patterns' (RHEL-104135)
    - Revert 'coredump: verify pidfd after parsing data in usermode helper' (RHEL-104135)

    [257-13.1]
    - coredump: verify pidfd after parsing data in usermode helper (RHEL-104135)
    - coredump: restore compatibility with older patterns (RHEL-104135)
    - coredump: wrap long lines, fix grammar in comments (RHEL-104135)
    - coredump: get rid of _META_MANDATORY_MAX (RHEL-104135)
    - coredump: use %d in kernel core pattern (RHEL-104135)
    - coredump: also stop forwarding non-dumpable processes (RHEL-104135)
    - coredump: get rid of a bogus assertion (RHEL-104135)
    - coredump: add support for new %F PIDFD specifier (RHEL-104135)
    - coredump: when %F/pidfd is used, again allow forwarding to containers (RHEL-104135)
    - coredump: introduce an enum to wrap dumpable constants (RHEL-104135)
    - Define helper to call PR_SET_DUMPABLE (RHEL-104135)
    - coredump: fix 0-passed-as-pointer warning (RHEL-104135)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-13677 advisory.

    - coredump: use %d in kernel core pattern - CVE-2025-4598

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:13677 advisory.

    * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data     (CVE-2026-29111)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:13677 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data     (CVE-2026-29111)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:13651 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data     (CVE-2026-29111)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4533 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4533-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                     Arnaud Rebillout     April 15, 2026                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : systemd     Version        : 247.3-7+deb11u8     CVE ID         : CVE-2026-4105 CVE-2026-29111 CVE-2026-40225 CVE-2026-40226     Debian Bug     :

    The following vulnerabilities have been discovered systemd:

    CVE-2026-4105

        The systemd-machined service contains an Improper Access Control         vulnerability due to insufficient validation of the class parameter in         the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged         user can exploit this by attempting to register a machine with a         specific class value, which may leave behind a usable,         attacker-controlled machine object. This allows the attacker to invoke         methods on the privileged object, leading to the execution of         arbitrary commands with root privileges on the host system.

    CVE-2026-29111

        When an unprivileged IPC API call is made with spurious data, a stack         overwrite occurs, with the attacker controlled content.

    CVE-2026-40225

        udev: local root execution can occur via malicious hardware devices         and unsanitized kernel output.

    CVE-2026-40226

        nspawn: an escape-to-host action can occur via a crafted optional         config file.

    For Debian 11 bullseye, these problems have been fixed in version     247.3-7+deb11u8.

    We recommend that you upgrade your systemd packages.

    For the detailed security status of systemd please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/systemd

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the systemd package has been released.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20471-1 advisory.

    Update to systemd v257.13:

    Security issues:

    - CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method     (bsc#1259650).
    - CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
    - udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).

    Non security issues:

    - Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
    - Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
    - terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

    Changelog:

    - 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
    - 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
    - 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
    - fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)

    For a complete list of changes, visit:
     https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b78     84c2610647e92806d14b28

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1061-1 advisory.

    - CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method     (bsc#1259650).
    - CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
    - udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

    Changelog:

    - 6a38d88a42 machined: reject invalid class types when registering machines
    - 8c9a592e5a udev: fix review mixup
    - b57007a917 udev-builtin-net-id: print cescaped bad attributes
    - ee23c7604b udev-builtin-net_id: do not assume the current interface name is ethX
    - 0f63e799e6 udev: ensure tag parsing stays within bounds
    - 046f52ec12 udev: ensure there is space for trailing NUL before calling sprintf
    - 5be21460ce udev: check for invalid chars in various fields received from the kernel
    - 9559607b16 core/cgroup: avoid one unnecessary strjoina()
    - fcae348ca4 core: validate input cgroup path more prudently
    - a3ca6b3031 alloc-util: add strdupa_safe() + strndupa_safe() and use it everywhere
    - 08125d6b06 units: add dep on systemd-logind.service by user@.service

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1040-1 advisory.

    - CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method     (bsc#1259650).
    - CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
    - udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

    Changelog:

    - a943e3ce2f machined: reject invalid class types when registering machines
    - 71593f77db udev: fix review mixup
    - 73a89810b4 udev-builtin-net-id: print cescaped bad attributes
    - 0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
    - 40905232e2 udev: ensure tag parsing stays within bounds
    - 7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
    - d018ac1ea3 udev: check for invalid chars in various fields received from the kernel
    - aef6e11921 core/cgroup: avoid one unnecessary strjoina()
    - cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
    - 26a748f727 core: validate input cgroup path more prudently
    - 99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8119-1 advisory.

    It was discovered that systemd incorrectly handled certain cgroup paths. A local attacker could possibly     use this issue to cause systemd to crash, resulting in a denial of service. (CVE-2026-29111)

    It was discovered that the systemd udev component incorrectly handled certain fields received from the     kernel. An attacker with a malicious device could possibly use this issue to execute arbitrary code as an     administrator (root).

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an     unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an     assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is     not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions     older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known     workarounds are available. (CVE-2026-29111)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
312360	AlmaLinux 10 : systemd (ALSA-2026:13651)	Nessus	Alma Linux Local Security Checks	medium
312331	Oracle Linux 10 : systemd (ELSA-2026-13651)	Nessus	Oracle Linux Local Security Checks	medium
312312	Oracle Linux 9 : systemd (ELSA-2026-13677)	Nessus	Oracle Linux Local Security Checks	medium
312292	AlmaLinux 9 : systemd (ALSA-2026:13677)	Nessus	Alma Linux Local Security Checks	medium
312185	RHEL 9 : systemd (RHSA-2026:13677)	Nessus	Red Hat Local Security Checks	medium
312176	RHEL 10 : systemd (RHSA-2026:13651)	Nessus	Red Hat Local Security Checks	medium
307620	Debian dla-4533 : libnss-myhostname - security update	Nessus	Debian Local Security Checks	medium
306995	Photon OS 4.0: Systemd PHSA-2026-4.0-0998	Nessus	PhotonOS Local Security Checks	medium
306342	Photon OS 5.0: Systemd PHSA-2026-5.0-0819	Nessus	PhotonOS Local Security Checks	medium
305859	openSUSE 16 Security Update : systemd (openSUSE-SU-2026:20471-1)	Nessus	SuSE Local Security Checks	medium
303956	SUSE SLES15 Security Update : systemd (SUSE-SU-2026:1061-1)	Nessus	SuSE Local Security Checks	medium
303939	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : systemd (SUSE-SU-2026:1040-1)	Nessus	SuSE Local Security Checks	medium
303747	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : systemd vulnerabilities (USN-8119-1)	Nessus	Ubuntu Local Security Checks	medium
303456	Linux Distros Unpatched Vulnerability : CVE-2026-29111	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-29111

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium