systemd-machined unprivileged user arbitrary process termination vulnerability (CVE-2026-1500) analysis

Vulnerability Overview Vulnerability Name: systemd-machined: unprivileged users can terminate arbitrary processes CVE ID: CVE-2026-1500 Severity: 4.7 / 10 Description: When >= v259 (or v258 with a custom polkit policy allowing access) is running on a desktop system, unprivileged users logged into a desktop graphical session can terminate arbitrary processes, subject only to privilege restrictions. Impact Scope Affected Versions: >= 259 Unaffected Versions: - Versions < v259 are unaffected, unless local custom polkit policy files grant unprivileged access to the polkit action. - Versions < v258 are unaffected. - Not related to the systemd service manager (PID 1 or user session manager). - is typically not installed by default; it is usually installed as an optional separate package (e.g., ). - Terminal sessions or remote sessions (e.g., SSH) are not affected. Remediation Patched Versions: 262, 261.2, 260.4, 259.8, 258.10 Workaround: Restrict access to only privileged users by creating the file and adding the following content: Original Report Disclosure: allows a local unprivileged, active-session user to send arbitrary signals to root, targeting any non-PID-1 process, if it does not own the machine leader PID checked by , but the attacker-supplied supervisor PID is forwarded by with , then is called from root to , and the polkit action is short-circuited on Kill because returns true when equals the UID of the caller who registered the machine. Sink (File at HEAD 8a9137a.c): The supervisor pidfd is obtained via without a corresponding check. The upstream-added admin fast path in this same combination is an administrative shortcut—it does not close the vulnerability for unprivileged attackers who arrive at this branch with being false, and for whom the leader check remains. Attacker + Trust Boundary: Local unprivileged active-session user. Boundary: . The attacker's own session legitimately satisfies the action (polkit policy polkit active: yes). Exact Observable: No crash—authorization boundary crossing. A root-owned, non-PID-1 process receives the attacker's signal (e.g., SIGKILL) and is terminated (Killed). The discriminator is asynchronicity: the same root-owned PID is rejected when acting as the leader but accepted when acting as the supervisor (ownership check missing), leading to a successful root-context Kill. Minimized Reproduction: Using real (system scope, thus + polkit enabled) holding , as an unprivileged user (uid 1001) via varlink: 1. Negative Control: Register a machine where the leader is a root-owned PID—machined returns Permission denied (leader ownership check fails). 2. Attack Step A: Register a machine where the leader is one of the attacker's own PIDs and the supervisor is a target root-owned PID (e.g., 1000), and register (Killed). Registration succeeds (Attack Step B). 3. Attack Step B: Call with and signal=9—returns 0, the OS terminates the root-owned target ("spid" Killed). Root-owned PIDs are terminated by unprivileged users through root (honest vulnerability, proven by the underlying mechanism, distributed by distros, sending this end to pushed polkit 0.105, which does not understand modern unix-process pidfd principal fields, and 's live polkit query error falls back incorrectly at the tool level. independently returns error 0 for active sessions, confirming the precondition was sincerely granted: a POC-only shim simulated this grant to run end-to-end. The shim touches only the registration precondition gate—leader registration/failure and logic is nearly identical to HEAD, proving that leader ownership enforcement has not been weakened! Specific Fix: Add a mirror of the leader check (at with ), and do not call to let through the gate for the Kill path.

Goal Reached Thanks to every supporter — we hit 100%!

systemd-machined unprivileged user arbitrary process termination vulnerability (CVE-2026-1500) analysis

More from this source