CVE-2026-29111
Medium
Description
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.
SeverityMedium
CVSS5.5
Exploit probability—
ProductSystemd
PublishedMar 23, 2026
First seenMar 23, 2026
Weakness typeCWE-269Improper privilege management
How to fix
Update
- systemd_project systemd257.11, 258.5, 259.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| systemd_project systemd | 239 ≤ v < 257.11, 258 ≤ v < 258.5, 259 ≤ v < 259.2 | 257.11, 258.5, 259.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.