CVE-2026-15059: systemd-oomd Unprivileged User LPE via Path Traversal RCE

systemd-oomd: Unprivileged users can terminate arbitrary processes Vulnerability Overview Vulnerability Name: systemd-oomd: unprivileged users can terminate arbitrary processes CVE ID: CVE-2026-15059 CVSS v3 base metrics: - Attack vector: Local - Attack complexity: Low - Privileges required: None - User interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High Severity: Moderate (5.9 / 10) Affected Scope Affected Versions: >= 250 Fixed Versions: 261 260.3 259.7 258.9 Affected Components: - systemd-oomd - io.systemd.oom.ReportManagedOOMGroups - /run/systemd/oom/io.systemd.ManagedOOM - src/oom/oom-manager.c - src/oom/oom-util.c - src/basic/cgroup-util.c Attack Surface: - Unprivileged local users can terminate arbitrary local processes via the systemd-oom IPC API due to a missing path traversal validation. - An attacker can submit a path that appears to belong to their user slice but contains sufficient traversals to resolve to an attacker-controlled directory (such as ), thereby reading attacker-controlled resource pressure data and sending to PIDs chosen by the attacker. Remediation Patch Versions: - v261 (c04e8c4) - v260.3 (1a2a881) - v259.7 (367550c) - v258.9 (af4e02f) Workaround: - Disable unprivileged access to the socket by adding the following to : - Disable the service. Technical Root Cause Analysis Trust Boundary: - Source: Local unprivileged user input via . - Target: Privileged cgroup file reading and recursive process killing performed by . - False Assumption: Paths containing the component are safe when resolved to a real cgroup path. Authorization Based on Non-Normalized Path Text: - The request handler parses the cgroup-controlled JSON field, including , and then checks ownership for non-root senders. - derives the owner UID from the slice name in the provided cgroup path. - This check does not prove that the final filesystem target is a cgroup directory; it only proves that the submitted string contains a user slice component that resolves to the sender's UID. Post-authorization Normalization Allows Traversal Out of CGroupFS: - After authorization, cgroup helper functions construct the real filesystem path by concatenating , the untrusted cgroup path, and a suffix, then simplifying the result. - If the path contains , can reduce the constructed path to a location outside , for example into the attacker-controlled directory . Attacker-Controlled CGroup Data is Consumed: - reads group pressure and memory accounting files via the same path resolution helper. - The attacker can satisfy these reads with regular files and provide fabricated values that make the fake cgroup appear to exceed OOM management thresholds. Privileged Kill Target: - When selecting a cgroup to kill, increments accounting xattrs and sends to the PIDs listed in the resolved path. - The cgroup process iterator opens via . - Consequently, an attacker-controlled fake file can nominate arbitrary PIDs for to kill. Minor XAttr Symlink Following Issue: - The xattr update helper reads the existing xattr value, increments it, and writes it back. - Low-level helpers exhibit different symlink behavior: reads the symlink itself, while follows the symlink. This creates a constrained write-to-fixed-name xattr primitive when the attacker can place a symlink in the resolved cgroup path. Attacker Preconditions A local unprivileged account or equivalent local code execution. Ability to connect to the socket within the service's socket namespace. Ability to create cgroup-like directories and files visible within the service's socket namespace. Knowledge of target PIDs. is running and configured to manage OOM reporting. Exposed Interfaces World-accessible varlink socket: Method: Inputs of interest: - path - property - limit - duration - mode Candidate Kill Targets Privileged daemons performing state transitions. SUID helpers running during authentication operations. Package, firmware, printer, disk, or policy management services. Security monitoring or endpoint protection processes, if present. Availability-critical production services. Exploitation Walkthrough 1. Confirm that is running and that the managed OOM varlink socket exists at . 2. Read the caller's cgroup path from and identify the component used in the systemd user session hierarchy. 3. Create cgroup-like directories in a user-writable path, such as . 4. Populate fake cgroup accounting files with syntactically valid values, making the fake cgroup eligible for killing. 5. Place the target PID in the fake file. 6. Submit a varlink request with a that starts with a valid user cgroup path, then traverses out of into the fake directory. 7. Set each cgroup request object to: , property: , limit: 1, duration: 0. 8. Wait for to process the fake cgroup and send to the PID listed in the fake . Proof of Concept and Evidence Representative Payload Shape: Fake CGroup Directory Contents: End-to-End Reproducer:

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-15059: systemd-oomd Unprivileged User LPE via Path Traversal RCE

More from this source