CVE-2026-40226

Published: Apr 10, 2026Modified: Jun 17, 2026

6.4

Vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.5 / Impact: 5.9

Source: MITRE (Secondary)

Description

In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.

Affected (3)

Products: Systemd Project: Systemd

Systemd Project

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Systemd Project Systemd	From 233 to 257.12
Systemd Project Systemd	From 258 to 258.6
Systemd Project Systemd	From 259 to 259.4

Related CWEs

Use of Less Trusted Source

The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

References (1)

https://github.com/systemd/systemd/security/advisories/GHSA-9mj4-rrc3-gjcx

Source: cve@mitre.org

Vendor Advisory

Timeline

No history available yet.