DEBIAN-CVE-2026-15060
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-15060
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-15060.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-15060
- Upstream
- Published
- 2026-08-10T14:17:21Z
- Modified
- 2026-09-14T17:02:20Z
- Severity
-
- 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
When systemd-machined >= v259 (or v258 with a custom
polkitpolicy that allowsregister-machineaccess) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for theregister-machinepolkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected - References
Affected packages
Debian:14 / systemd
Package
- Name
- systemd
- Purl
- pkg:deb/debian/systemd?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed261.2-1
Affected versions
257.*
257.7-1
257.8-1~deb13u1
257.8-1~deb13u2
257.9-1~deb13u1
257.13-1~deb13u1
Other
258~rc1-1
258~rc2-1
258~rc2-2
258~rc3-1
258~rc4-1
258-1
259~rc1-1
259~rc2-1
259~rc3-1
259-1
260~rc1-1
260~rc1-2
260~rc2-1
260~rc3-1
260~rc4-1
260-1
261~rc1-1
261~rc2-1
261~rc3-1
261~rc4-1
261-1
261-2
258.*
258.1-1
258.1-2
259.*
259.1-1
260.*
260.1-1
261.*
261.1-1
261.1-2
261.1-3