UnratedFix available

DEBIAN-CVE-2026-40227

Type: advisorySource: OSV1 source record

In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.

Announced 10 Apr 2026Group revision 1

Original source ↗

DEBIAN-CVE-2026-40227

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-40227

systemd

Source reference: /affected/0/package/name

Affected versions: 257.13-1~deb13u1
Source reference: /affected/0/versions
257.7-1
Source reference: /affected/0/versions
257.8-1~deb13u1
Source reference: /affected/0/versions
257.8-1~deb13u2
Source reference: /affected/0/versions
257.9-1~deb13u1
Source reference: /affected/0/versions
258-1
Source reference: /affected/0/versions
258.1-1
Source reference: /affected/0/versions
258.1-2
Source reference: /affected/0/versions
258~rc1-1
Source reference: /affected/0/versions
258~rc2-1
Source reference: /affected/0/versions
258~rc2-2
Source reference: /affected/0/versions
258~rc3-1
Source reference: /affected/0/versions
258~rc4-1
Source reference: /affected/0/versions
259-1
Source reference: /affected/0/versions
259.1-1
Source reference: /affected/0/versions
259~rc1-1
Source reference: /affected/0/versions
259~rc2-1
Source reference: /affected/0/versions
259~rc3-1
Source reference: /affected/0/versions
260-1
Source reference: /affected/0/versions
260~rc1-1
Source reference: /affected/0/versions
260~rc1-2
Source reference: /affected/0/versions
260~rc2-1
Source reference: /affected/0/versions
260~rc3-1
Source reference: /affected/0/versions
260~rc4-1
Source reference: /affected/0/versions
Fixed versions: 260.1-1
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "260.1-1"
          }
        ]
      }
    ],
    "package": {
      "name": "systemd",
      "purl": "pkg:deb/debian/systemd?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "257.13-1~deb13u1",
      "257.7-1",
      "257.8-1~deb13u1",
      "257.8-1~deb13u2",
      "257.9-1~deb13u1",
      "258-1",
      "258.1-1",
      "258.1-2",
      "258~rc1-1",
      "258~rc2-1",
      "258~rc2-2",
      "258~rc3-1",
      "258~rc4-1",
      "259-1",
      "259.1-1",
      "259~rc1-1",
      "259~rc2-1",
      "259~rc3-1",
      "260-1",
      "260~rc1-1",
      "260~rc1-2",
      "260~rc2-1",
      "260~rc3-1",
      "260~rc4-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-40227.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #56477 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 16:38:04 GMT
Publisher date: Fri, 10 Apr 2026 16:16:33 GMT

Read the original announcement

Revision history

25 Oct 2026DEBIAN-CVE-2026-40227 · Revision 1Source updated