Bug 2450505 (CVE-2026-29111) - CVE-2026-29111 systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data
Summary: CVE-2026-29111 systemd: systemd: Arbitrary code execution or Denial of Servic...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2026-29111
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2450658 2450659 2450655 2450656 2450657 2450660
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-23 22:02 UTC by OSIDB Bzimport
Modified: 2026-08-06 20:30 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-03-24 10:38:16 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2026:13835 0 None None None 2026-05-05 17:25:09 UTC
Red Hat Product Errata RHBA-2026:14134 0 None None None 2026-05-06 12:47:35 UTC
Red Hat Product Errata RHBA-2026:14170 0 None None None 2026-05-06 17:26:36 UTC
Red Hat Product Errata RHBA-2026:14389 0 None None None 2026-05-06 21:08:54 UTC
Red Hat Product Errata RHBA-2026:14793 0 None None None 2026-05-07 13:00:43 UTC
Red Hat Product Errata RHBA-2026:15886 0 None None None 2026-05-11 01:01:47 UTC
Red Hat Product Errata RHBA-2026:16920 0 None None None 2026-05-13 08:58:48 UTC
Red Hat Product Errata RHBA-2026:19707 0 None None None 2026-05-20 16:37:44 UTC
Red Hat Product Errata RHSA-2026:13651 0 None None None 2026-05-05 09:19:05 UTC
Red Hat Product Errata RHSA-2026:13677 0 None None None 2026-05-05 10:23:53 UTC
Red Hat Product Errata RHSA-2026:19068 0 None None None 2026-05-19 13:07:51 UTC
Red Hat Product Errata RHSA-2026:19213 0 None None None 2026-05-19 18:02:41 UTC
Red Hat Product Errata RHSA-2026:25900 0 None None None 2026-06-15 01:41:13 UTC
Red Hat Product Errata RHSA-2026:49910 0 None None None 2026-08-04 07:18:11 UTC
Red Hat Product Errata RHSA-2026:50050 0 None None None 2026-08-04 11:56:57 UTC
Red Hat Product Errata RHSA-2026:50051 0 None None None 2026-08-04 11:53:44 UTC
Red Hat Product Errata RHSA-2026:50077 0 None None None 2026-08-04 13:11:56 UTC
Red Hat Product Errata RHSA-2026:51134 0 None None None 2026-08-06 15:56:37 UTC
Red Hat Product Errata RHSA-2026:51277 0 None None None 2026-08-06 20:30:31 UTC

Description OSIDB Bzimport 2026-03-23 22:02:18 UTC 
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.
Comment 2 Íñigo Huguet 2026-03-24 10:38:16 UTC 
Per the description of the vulnerability: https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764

NetworkManager is not affected, as it only takes some code from systemd for DHCPv6. This is related to the systemd's D-Bus API, for which NM shares no code at all.
Comment 3 errata-xmlrpc 2026-05-05 09:19:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:13651 https://access.redhat.com/errata/RHSA-2026:13651
Comment 4 errata-xmlrpc 2026-05-05 10:23:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:13677 https://access.redhat.com/errata/RHSA-2026:13677
Comment 6 errata-xmlrpc 2026-05-19 13:07:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19068 https://access.redhat.com/errata/RHSA-2026:19068
Comment 7 errata-xmlrpc 2026-05-19 18:02:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19213 https://access.redhat.com/errata/RHSA-2026:19213
Comment 14 errata-xmlrpc 2026-06-15 01:41:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:25900 https://access.redhat.com/errata/RHSA-2026:25900
Comment 15 errata-xmlrpc 2026-08-04 07:18:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:49910 https://access.redhat.com/errata/RHSA-2026:49910
Comment 16 errata-xmlrpc 2026-08-04 11:53:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:50051 https://access.redhat.com/errata/RHSA-2026:50051
Comment 17 errata-xmlrpc 2026-08-04 11:56:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:50050 https://access.redhat.com/errata/RHSA-2026:50050
Comment 18 errata-xmlrpc 2026-08-04 13:11:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:50077 https://access.redhat.com/errata/RHSA-2026:50077
Comment 19 errata-xmlrpc 2026-08-06 15:56:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:51134 https://access.redhat.com/errata/RHSA-2026:51134
Comment 20 errata-xmlrpc 2026-08-06 20:30:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:51277 https://access.redhat.com/errata/RHSA-2026:51277
Note You need to log in before you can comment on or make changes to this bug.