CVE-2026-40225

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40225
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40225.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40225
Aliases
  • GHSA-vpfq-8p5f-jcqx
Downstream
Related
Published
2026-04-10T15:16:19.827Z
Modified
2026-08-04T11:50:53.538404651Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Database specific 
{
    "cwe_ids": [
        "CWE-669"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40225.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/systemd/systemd

Affected ranges

Type
GIT
Repo
https://github.com/systemd/systemd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3e52279684a53ebf84d1d73d528bf400c5fb3497
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "260"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

Other
v1
v10
v11
v12
v13
v14
v15
v16
v17
v18
v183
v184
v185
v186
v187
v188
v189
v19
v190
v191
v192
v193
v194
v195
v196
v197
v198
v199
v2
v20
v200
v201
v202
v203
v204
v205
v206
v207
v208
v209
v21
v210
v211
v212
v213
v214
v215
v216
v217
v218
v219
v22
v220
v221
v222
v223
v224
v225
v226
v227
v228
v229
v23
v230
v231
v232
v233
v234
v235
v236
v237
v238
v239
v24
v240
v241
v241-rc1
v241-rc2
v242
v242-rc1
v242-rc2
v242-rc3
v242-rc4
v243
v243-rc1
v243-rc2
v244
v244-rc1
v245
v245-rc1
v245-rc2
v246
v246-rc1
v246-rc2
v247
v247-rc1
v247-rc2
v248
v248-2
v248-rc1
v248-rc2
v248-rc3
v248-rc4
v249
v249-rc1
v249-rc2
v249-rc3
v25
v250
v250-rc1
v250-rc2
v250-rc3
v251
v251-rc1
v251-rc2
v251-rc3
v252
v252-rc1
v252-rc2
v252-rc3
v253
v253-rc1
v253-rc2
v253-rc3
v254
v254-rc1
v254-rc2
v254-rc3
v255
v255-rc1
v255-rc2
v255-rc3
v255-rc4
v256
v256-rc1
v256-rc2
v256-rc3
v256-rc4
v257
v257-rc1
v257-rc2
v257-rc3
v258
v258-rc1
v258-rc2
v258-rc3
v258-rc4
v259
v259-rc1
v259-rc2
v259-rc3
v26
v260-rc1
v260-rc2
v260-rc3
v260-rc4
v27
v28
v29
v3
v30
v31
v32
v33
v34
v35
v36
v37
v38
v39
v4
v40
v41
v42
v43
v44
v5
v6
v7
v8
v9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40225.json"