CVE-2026-15059

Published: Aug 10, 2026Modified: Sep 1, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: 98a521c5-3a3e-4e2b-bc27-002067e0463c (Secondary)

Description

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (2)

https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6

Source: 98a521c5-3a3e-4e2b-bc27-002067e0463c

https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.