CVE-2026-29111: systemd: Local unprivileged user can trigger an assert
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.
Other sources
systemd: Local unprivileged user can trigger an assert
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29111?
CVE-2026-29111 is considered a significant vulnerability due to its potential to disrupt system operations and compromise system stability.
How do I fix CVE-2026-29111?
To mitigate CVE-2026-29111, ensure that your systemd version is updated to a version later than v259.2, v258.5, or v257.11.
Who is affected by CVE-2026-29111?
CVE-2026-29111 affects users running vulnerable versions of systemd, specifically those from v239 to v259.2.
What types of attacks can CVE-2026-29111 allow?
CVE-2026-29111 can allow an unprivileged local user to execute an IPC API call that triggers an assertion failure, potentially leading to denial of service.
When was CVE-2026-29111 disclosed?
CVE-2026-29111 was disclosed as a vulnerability in systemd with impacts related to its IPC API handling.