Skip to content
Fencer Vulns
medium 5.5

CVE-2026-29111 json

systemd: Local unprivileged user can trigger an assert

published 2026-03-23 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-14562

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits
0
none known

Summary

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

Patch / fix

  • freedesktop systemd 257.11, 258.5, 259.2
  • systemd_project systemd 257.11, 258.5, 259.2
  • systemd Debian 12 252.39-1~deb12u2
  • systemd Debian 13 257.13-1~deb13u1
  • systemd Debian 14 260~rc2-1

debian advisories DEBIAN-CVE-2026-29111

  • systemd Ubuntu 22.04 LTS 249.11-0ubuntu3.19
  • systemd Ubuntu 24.04 LTS 255.4-1ubuntu8.14
  • systemd Ubuntu 25.10 257.9-0ubuntu2.3
  • systemd Ubuntu Pro 20.04 LTS 245.4-4ubuntu3.24+esm3

ubuntu advisories UBUNTU-CVE-2026-29111

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • systemd RHEL 9 252-67.el9_8.2
  • systemd-pam RHEL 9 252-67.el9_8.2
  • systemd-libs RHEL 9 252-67.el9_8.2
  • systemd-oomd RHEL 9 252-67.el9_8.2
  • systemd-udev RHEL 9 252-67.el9_8.2
  • systemd-ukify RHEL 9 252-67.el9_8.2
  • systemd-resolved RHEL 9 252-67.el9_8.2
  • systemd-container RHEL 9 252-67.el9_8.2

red hat advisories RHSA-2026:51277RHSA-2026:51134RHSA-2026:50077RHSA-2026:50051RHSA-2026:50050RHSA-2026:49910

  • systemd SLES 16.0, Linux Micro Extras 6.2, Linux Micro 6.2 +1 more 257.13-160000.4.1
  • systemd SLES 16.0, Linux Micro Extras 6.2, Linux Micro 6.2 +1 more 257.13-160000.1.1
  • systemd SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 249.17-150400.8.55.1
  • systemd SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Package Hub 15 SP7 +2 more 254.27-150600.4.62.1
  • systemd Linux Micro 6.1 254.27-slfo.1.1_4.1
  • systemd Linux Micro 6.0 254.27-3.1
  • systemd SLE Micro 5.2 246.16-150300.7.65.1

suse advisories SUSE-SU-2026:23470-1SUSE-SU-2026:23620-1SUSE-SU-2026:23454-1SUSE-SU-2026:20998-1SUSE-SU-2026:21003-1SUSE-SU-2026:21144-1

  • systemd openSUSE Leap 16.0 257.13-160000.4.1
  • systemd-mini openSUSE Leap 16.0 257.13-160000.4.1
  • systemd openSUSE Tumbleweed 259.5-1.3
  • systemd openSUSE Leap 16.0 257.13-160000.1.1

opensuse advisories openSUSE-SU-2026:21754-1openSUSE-SU-2026:10624-1openSUSE-SU-2026:20471-1

  • systemd AlmaLinux 10 257-23.el10_2.1.alma.1
  • systemd-pam AlmaLinux 10 257-23.el10_2.1.alma.1
  • systemd-libs AlmaLinux 10 257-23.el10_2.1.alma.1
  • systemd-oomd AlmaLinux 10 257-23.el10_2.1.alma.1
  • systemd-udev AlmaLinux 10 257-23.el10_2.1.alma.1
  • systemd-ukify AlmaLinux 10 257-23.el10_2.1.alma.1
  • systemd-resolved AlmaLinux 10 257-23.el10_2.1.alma.1
  • systemd-container AlmaLinux 10 257-23.el10_2.1.alma.1

almalinux advisories ALSA-2026:19068ALSA-2026:19213ALSA-2026:13651ALSA-2026:13677

  • systemd Rocky Linux 9 252-67.el9_8.2.rocky.0.1
  • systemd Rocky Linux 10 257-23.el10_2.1.rocky.0.1
  • systemd Rocky Linux 10 257-13.el10_1.3.rocky.0.1
  • systemd Rocky Linux 9 252-55.el9_7.9.rocky.0.1

rocky linux advisories RLSA-2026:19213RLSA-2026:19068RLSA-2026:13651RLSA-2026:13677

  • systemd Azure Linux 3.0 255-26
  • systemd-bootstrap Azure Linux 3.0 250.3-19

azure linux advisories AZL-80538AZL-80937

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-29111 updated cvss 7.8

systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data

  • Red Hat Enterprise Linux 8 systemd, systemd-pam, systemd-libs, systemd-udev, systemd-tests, NetworkManager, +16 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 NetworkManager, NetworkManager-ovs, NetworkManager-ppp, NetworkManager-tui, NetworkManager-adsl, NetworkManager-team, +9 more Red Hat Enterprise Linux 10 NetworkManager
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 systemd, systemd-pam, systemd-libs, systemd-oomd, systemd-udev, systemd-tests, +7 more
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/ose-hypershift-rhel9
    under investigation
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/cert-manager-operator-bundle 1791970484, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
    fixed: vendor fix RHSA-2026:82888
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix RHSA-2026:82354
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.20 cert-manager/cert-manager-trust-manager-rhel9 1790598593
    fixed: vendor fix RHSA-2026:72502
  • Red Hat Enterprise Linux AppStream (v. 9) systemd-ukify 252-55.el9_7.9, systemd-ukify 252-67.el9_8.2, systemd-boot-unsigned 252-55.el9_7.9, systemd-boot-unsigned 252-67.el9_8.2, systemd-journal-remote 252-55.el9_7.9, systemd-journal-remote 252-67.el9_8.2
    fixed: vendor fix RHSA-2026:13677
show 31 more
  • Red Hat Enterprise Linux AppStream (v. 10) systemd-ukify 257-13.el10_1.3, systemd-ukify 257-23.el10_2.1, systemd-boot-unsigned 257-13.el10_1.3, systemd-boot-unsigned 257-23.el10_2.1, systemd-journal-remote 257-13.el10_1.3, systemd-journal-remote 257-23.el10_2.1
    fixed: vendor fix RHSA-2026:13651
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) systemd-journal-remote 252-14.el9_2.11
    fixed: vendor fix RHSA-2026:51277
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) systemd-journal-remote 252-32.el9_4.11
    fixed: vendor fix RHSA-2026:51134
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) systemd-ukify 257-9.el10_0.2, systemd-boot-unsigned 257-9.el10_0.2, systemd-journal-remote 257-9.el10_0.2
    fixed: vendor fix RHSA-2026:25900
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) systemd-ukify 252-51.el9_6.6, systemd-boot-unsigned 252-51.el9_6.6, systemd-journal-remote 252-51.el9_6.6
    fixed: vendor fix RHSA-2026:49910
  • Red Hat Enterprise Linux BaseOS (v. 9) systemd 252-55.el9_7.9, systemd 252-67.el9_8.2, systemd-pam 252-55.el9_7.9, systemd-pam 252-67.el9_8.2, systemd-libs 252-55.el9_7.9, systemd-libs 252-67.el9_8.2, +12 more
    fixed: vendor fix RHSA-2026:13677
  • Red Hat Enterprise Linux BaseOS (v. 10) systemd 257-13.el10_1.3, systemd 257-23.el10_2.1, systemd-pam 257-13.el10_1.3, systemd-pam 257-23.el10_2.1, systemd-libs 257-13.el10_1.3, systemd-libs 257-23.el10_2.1, +10 more
    fixed: vendor fix RHSA-2026:13651
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) systemd 239-45.el8_4.17, systemd-pam 239-45.el8_4.17, systemd-libs 239-45.el8_4.17, systemd-udev 239-45.el8_4.17, systemd-tests 239-45.el8_4.17, systemd-container 239-45.el8_4.17, +1 more
    fixed: vendor fix RHSA-2026:50051
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) systemd 239-58.el8_6.16, systemd-pam 239-58.el8_6.16, systemd-libs 239-58.el8_6.16, systemd-udev 239-58.el8_6.16, systemd-tests 239-58.el8_6.16, systemd-container 239-58.el8_6.16, +1 more
    fixed: vendor fix RHSA-2026:50077
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) systemd 239-74.el8_8.7, systemd-pam 239-74.el8_8.7, systemd-libs 239-74.el8_8.7, systemd-udev 239-74.el8_8.7, systemd-tests 239-74.el8_8.7, systemd-container 239-74.el8_8.7, +1 more
    fixed: vendor fix RHSA-2026:50050
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) systemd 252-14.el9_2.11, systemd-pam 252-14.el9_2.11, systemd-libs 252-14.el9_2.11, systemd-oomd 252-14.el9_2.11, systemd-udev 252-14.el9_2.11, systemd-resolved 252-14.el9_2.11, +3 more
    fixed: vendor fix RHSA-2026:51277
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4) systemd 252-32.el9_4.11, systemd-pam 252-32.el9_4.11, systemd-libs 252-32.el9_4.11, systemd-oomd 252-32.el9_4.11, systemd-udev 252-32.el9_4.11, systemd-resolved 252-32.el9_4.11, +3 more
    fixed: vendor fix RHSA-2026:51134
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) systemd 257-9.el10_0.2, systemd-pam 257-9.el10_0.2, systemd-libs 257-9.el10_0.2, systemd-oomd 257-9.el10_0.2, systemd-udev 257-9.el10_0.2, systemd-resolved 257-9.el10_0.2, +2 more
    fixed: vendor fix RHSA-2026:25900
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) systemd 252-51.el9_6.6, systemd-pam 252-51.el9_6.6, systemd-libs 252-51.el9_6.6, systemd-oomd 252-51.el9_6.6, systemd-udev 252-51.el9_6.6, systemd-resolved 252-51.el9_6.6, +3 more
    fixed: vendor fix RHSA-2026:49910
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) systemd 239-45.el8_4.17, systemd-pam 239-45.el8_4.17, systemd-libs 239-45.el8_4.17, systemd-udev 239-45.el8_4.17, systemd-tests 239-45.el8_4.17, systemd-container 239-45.el8_4.17, +1 more
    fixed: vendor fix RHSA-2026:50051
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) systemd 239-58.el8_6.16, systemd-pam 239-58.el8_6.16, systemd-libs 239-58.el8_6.16, systemd-udev 239-58.el8_6.16, systemd-tests 239-58.el8_6.16, systemd-container 239-58.el8_6.16, +1 more
    fixed: vendor fix RHSA-2026:50077
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) systemd 239-74.el8_8.7, systemd-pam 239-74.el8_8.7, systemd-libs 239-74.el8_8.7, systemd-udev 239-74.el8_8.7, systemd-tests 239-74.el8_8.7, systemd-container 239-74.el8_8.7, +1 more
    fixed: vendor fix RHSA-2026:50050
  • Red Hat Hardened Images systemd 260.1-2.1.hum1, systemd-pam 260.1-2.1.hum1, systemd-libs 260.1-2.1.hum1, systemd-udev 260.1-2.1.hum1, systemd-tests 260.1-2.1.hum1, systemd-ukify 260.1-2.1.hum1, +14 more
    fixed: vendor fix RHSA-2026:7299
  • Red Hat Insights proxy 1.5 insights-proxy/insights-proxy-container-rhel9 1780420428
    fixed: vendor fix RHSA-2026:22634
  • Red Hat OpenShift AI 3.0 rhai/base-image-cpu-rhel9 1790277045, rhai/base-image-tpu-rhel9 1790276884, rhai/base-image-cuda-rhel9 1790276974, rhai/base-image-rocm-rhel9 1790276886, rhai/base-image-spyre-rhel9 1790276889
    fixed: vendor fix RHSA-2026:73960
  • Red Hat OpenShift AI 3.2 rhai/base-image-cpu-rhel9 1790703590, rhai/base-image-tpu-rhel9 1790703497, rhai/base-image-cuda-rhel9 1790703586, rhai/base-image-rocm-rhel9 1790703494, rhai/base-image-rocm-rhel9 1790703506, rhai/base-image-spyre-rhel9 1790703568
    fixed: vendor fix RHSA-2026:74460
  • Red Hat OpenShift AI 3.4 rhai/base-image-neuron-rhel9 1790703542
    fixed: vendor fix RHSA-2026:74674
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202608241157
    fixed: vendor fix RHSA-2026:59831
  • Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202609080414
    fixed: vendor fix RHSA-2026:65839
  • Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202609011250
    fixed: vendor fix RHSA-2026:62409
  • Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202609140326
    fixed: vendor fix RHSA-2026:67857
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202609011112
    fixed: vendor fix RHSA-2026:62549
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202608250221
    fixed: vendor fix RHSA-2026:60019
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202608142238, rhcos 418.94.202609031320
    fixed: vendor fix RHSA-2026:57483
  • Red Hat OpenShift Container Platform 4.19 rhcos 4.19.9.6.202608182320
    fixed: vendor fix RHSA-2026:57402
  • Red Hat OpenShift distributed tracing 3.9.3 rhosdt 1778056233, rhosdt 1778056245, rhosdt 1778056267
    fixed: vendor fix RHSA-2026:14162

1 more fixed, 5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • systemd systemd

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.