CVE-2026-40225

Published: Apr 10, 2026Modified: Jun 17, 2026

6.4

Vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.5 / Impact: 5.9

Source: MITRE (Secondary)

Description

In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.

Affected (3)

Products: Systemd Project: Systemd

Systemd Project

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Systemd Project Systemd	Before 257.13
Systemd Project Systemd	From 258 to 258.7
Systemd Project Systemd	From 259 to 259.5

Related CWEs

Incorrect Resource Transfer Between Spheres

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

References (1)

https://github.com/systemd/systemd/security/advisories/GHSA-vpfq-8p5f-jcqx

Source: cve@mitre.org

Vendor Advisory

Timeline

No history available yet.