CVE-2026-40224 Privilege escalation in systemd

What is CVE-2026-40224?

CVE-2026-40224 is a medium-severity vulnerability in Systemd Project Systemd, published on 10 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.

Weakness: CWE-863

Which versions are affected by CVE-2026-40224?

It affects 1 product.

Products include Systemd Project Systemd.

How do I fix CVE-2026-40224?

Upgrade to a fixed version.

Is CVE-2026-40224 being exploited?

There is no known exploitation of CVE-2026-40224 in the wild and no public exploit code.

Other vulnerabilities in Systemd Project Systemd

• CVE-2015-7510 Memory corruption in n/a Critical 9.8
• CVE-2017-1000082 Privilege escalation in n/a Critical 9.8
• CVE-2016-10156 Privilege escalation in n/a High 7.8
• CVE-2017-9445 Memory corruption in n/a High 7.5
• CVE-2017-9217 Null dereference in n/a High 7.5

All Systemd Project Systemd vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-40224, GHSA-6pwp-j5vg-5j6m, GHSA-jf3x-2pf6-c45w, openSUSE-SU-2026:10840-1.