CVE-2026-40224 - systemd/systemd
In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.
CWE-863 / CVSS 6.7 (MEDIUM)
Evidence
- Assert removal is behavior-neutral; existing guard already denies
- Needs reframe as hardening plus coverage, not a CVE fix
History
- 2026-10-28: needs-rework - No distinguishing red/green demonstrated
- 2026-10-28: fork-fixed - reframed as hardening; merged to fork main 0e00565