CVE-2026-15059

NameCVE-2026-15059
DescriptionLocal unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
systemd (PTS)bullseye247.3-7+deb11u5vulnerable
bullseye (security)247.3-7+deb11u8vulnerable
bookworm252.39-1~deb12u2vulnerable
bookworm (security)252.38-1~deb12u1vulnerable
trixie257.13-1~deb13u1vulnerable
forky, sid261.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
systemdsource(unstable)261~rc3-1

Notes

[trixie] - systemd <no-dsa> (Minor issue)
https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6
Fixed by: https://github.com/systemd/systemd/commit/cde88c4ea364e816619f385a870d074ebc12fe0f (v261-rc3)
Fixed by: https://github.com/systemd/systemd/commit/a8feb2f23565d39df5c90a753c851c1934a53117 (v258.9)

Search for package or bug name: Reporting problems