SUSE-SU-2026:20998-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-202620998-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:20998-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2026:20998-1
- Upstream
CVE (2)
- Related
- Published
- 2026-04-07T15:08:39Z
- Modified
- 2026-07-09T18:24:05Z
- Summary
- Security update for systemd
- Details
-
This update for systemd fixes the following issues:
Update to systemd v257.13:
Security issues:
- CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
- CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
- udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).
Non security issues:
- Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
- Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
- terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
Changelog:
- 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
- 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
- 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
- fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b7884c2610647e92806d14b28
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-202620998-1/
- https://bugzilla.suse.com/1255326
- https://bugzilla.suse.com/1258344
- https://bugzilla.suse.com/1259418
- https://bugzilla.suse.com/1259650
- https://bugzilla.suse.com/1259697
- https://www.suse.com/security/cve/CVE-2026-29111
- https://www.suse.com/security/cve/CVE-2026-4105