{"id":"CVE-2026-29111","summary":"systemd: Local unprivileged user can trigger an assert","details":"systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.","aliases":["GHSA-gx6q-6f99-m764"],"modified":"2026-10-24T10:53:30.273863418Z","published":"2026-03-23T21:03:56.120Z","related":["ALSA-2026:13651","ALSA-2026:13677","ALSA-2026:19068","ALSA-2026:19213","SUSE-SU-2026:0990-1","SUSE-SU-2026:1040-1","SUSE-SU-2026:1061-1","SUSE-SU-2026:20822-1","SUSE-SU-2026:20826-1","SUSE-SU-2026:20998-1","SUSE-SU-2026:21003-1","SUSE-SU-2026:21144-1","SUSE-SU-2026:23454-1","SUSE-SU-2026:23470-1","SUSE-SU-2026:23620-1","openSUSE-SU-2026:10624-1","openSUSE-SU-2026:20471-1","openSUSE-SU-2026:21754-1"],"database_specific":{"cwe_ids":["CWE-269"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29111.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29111.json"},{"type":"ADVISORY","url":"https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29111"},{"type":"FIX","url":"https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a"},{"type":"FIX","url":"https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6"},{"type":"FIX","url":"https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412"},{"type":"FIX","url":"https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd"},{"type":"FIX","url":"https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f"},{"type":"FIX","url":"https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f"},{"type":"FIX","url":"https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"},{"type":"FIX","url":"https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6"},{"type":"FIX","url":"https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c"},{"type":"FIX","url":"https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/systemd/systemd","events":[{"introduced":"de7436b02badc82200dc127ff190b8155769b8e7"},{"fixed":"4f55c3e0250a674c9d7f53a89c8e77b03ec8f1c3"},{"introduced":"781d9d0789379d1ea1f2ecefb804d41e9c8b6c38"},{"fixed":"943028cdb065285c11b6799595e6665a8dba0d44"},{"introduced":"9ca433482f2281d71718718705ca8cd3bf562ad6"},{"fixed":"f2b815a9a166ee14f8c5a827b878806db1d88bbd"},{"fixed":"1d22f706bd04f45f8422e17fbde3f56ece17758a"},{"fixed":"20021e7686426052e3a7505425d7e12085feb2a6"},{"fixed":"21167006574d6b83813c7596759b474f56562412"},{"fixed":"3cee294fe8cf4fa0eff933ab21416d099942cabd"},{"fixed":"42aee39107fbdd7db1ccd402a2151822b2805e9f"},{"fixed":"54588d2dedff54bfb6036670820650e4ea74628f"},{"fixed":"7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"},{"fixed":"80acea4ef80a4bb78560ed970c34952299b890d6"},{"fixed":"b5fd14693057e5f2c9b4a49603be64ec3608ff6c"},{"fixed":"efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"239"},{"fixed":"257.11"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*"},{"range":[{"introduced":"258"},{"fixed":"258.5"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*","range":[{"introduced":"259"},{"fixed":"259.2"}],"source":"CPE_RANGE"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"1d22f706bd04f45f8422e17fbde3f56ece17758a"}]},{"range":[{"fixed":"20021e7686426052e3a7505425d7e12085feb2a6"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"21167006574d6b83813c7596759b474f56562412"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"3cee294fe8cf4fa0eff933ab21416d099942cabd"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"42aee39107fbdd7db1ccd402a2151822b2805e9f"}]},{"range":[{"fixed":"54588d2dedff54bfb6036670820650e4ea74628f"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"80acea4ef80a4bb78560ed970c34952299b890d6"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"b5fd14693057e5f2c9b4a49603be64ec3608ff6c"}]},{"range":[{"fixed":"efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v258.4","v260-rc1","v259.1","v259","v258.3","v257.10","v258.2","v258.1","v257.9","v258","v257.8","v257.7","v257.6","v257.5","v257.4","v257.3","v257.2","v257.1","v257","v257-rc3","v257-rc2","v257-rc1","v256","v256-rc4","v256-rc3","v256-rc2","v256-rc1","v255","v255-rc4","v255-rc3","v255-rc2","v255-rc1","v254","v254-rc3","v254-rc2","v254-rc1","v253","v252","v253-rc3","v253-rc2","v253-rc1","v252-rc3","v252-rc2","v252-rc1","v251","v251-rc3","v251-rc2","v251-rc1","v250","v250-rc3","v250-rc2","v250-rc1","v249","v249-rc3","v249-rc2","v249-rc1","v248-2","v248","v248-rc4","v248-rc3","v248-rc2","v248-rc1","v247","v247-rc2","v247-rc1","v246","v246-rc2","v246-rc1","v245","v245-rc2","v245-rc1","v244","v244-rc1","v243","v243-rc2","v243-rc1","v242","v242-rc4","v242-rc3","v242-rc2","v242-rc1","v241","v241-rc2","v241-rc1","v240","v239"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-29111.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}