CVE-2026-40226 - systemd/systemd
In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.
CWE-348 / CVSS 6.4 (MEDIUM)
Evidence
- Traversal vectors rejected with EINVAL, normals accepted
- Tested against real systemd-nspawn after rework
- Adversarial review passed after rework
History
- 2026-10-28: needs-rework - Committed test never executed; reworked live
- 2026-10-28: fork-fixed - Merged to fork main