CVE-2026-16742: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-16742 is a local privilege escalation vulnerability in systemd-homed caused by missing cryptographic signature verification on the home_authenticating_finish code path. A locally logged-in, homed-managed user can forge security-relevant fields in their own home record (e.g., memberOf) and have systemd-homed adopt the tampered record without verifying its signature, enabling escalation to root. All releases of systemd-homed from v245 through v261 (and current main at time of disclosure) are affected; fixed versions are 262, 261.2, 260.4, 259.8, and 258.10. The vulnerability was published on August 10, 2026, with a CVSS v3.1 base score of 6.7 (Medium) (GitHub Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature) and CWE-269 (Improper Privilege Management). The home_authenticating_finish() handler in homed-home.c calls home_set_record() to adopt the worker-returned user record without first calling home_verify_user_record() — a check that the sibling handlers home_fixate_finish() and home_activate_finish() both perform correctly. The worker process (systemd-homework) reads the user-owned ~/.identity file (writable by the user at mode 0600), and user_record_reconcile() selects the winning record purely by lastChangeUSec timestamp with no signature check; a user can therefore bump the timestamp and inject arbitrary fields such as memberOf: ["sudo"]. The adopted record is then served verbatim over the io.systemd.UserDatabase Varlink socket, and nss-systemd's initgroups translates those memberships into real supplementary GIDs for any newly-established session. The homectl authenticate verb is owner-authorized via polkit without requiring admin credentials, making the entire attack chain accessible to the unprivileged account owner (GitHub Advisory).

Successful exploitation allows an unprivileged homed-managed user to escalate to root by injecting themselves into privileged groups such as sudo, wheel, docker, disk, or shadow. Beyond group injection, the attacker can bypass account lockout or expiry by clearing the locked flag or resetting notBeforeUSec/notAfterUSec, and can downgrade authentication security by removing FIDO2 or PKCS#11 second-factor requirements or weakening rate-limit settings — all without any administrator credential. The impact is rated High across confidentiality, integrity, and availability, with full system compromise achievable on any host managing users via homectl/homed (GitHub Advisory).

A detailed, turnkey proof-of-concept reproduction script is publicly available in the official GitHub Security Advisory, targeting any disposable VM running a vulnerable systemd version. Exploitation requires a local, active homed-managed user session and one fresh login after the forged record is adopted (user interaction required), and attack complexity is rated High due to the "keep-home-active + one fresh login" precondition. The EPSS score is approximately 0.057% (low probability of near-term automated exploitation), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the disclosure date (GitHub Advisory).

1. Precondition: Obtain a local, unprivileged account managed by systemd-homed (created via homectl create) on a system running systemd v245–v261 with systemd-homed active.
2. Activate home: Log in or use homectl activate to mount the home directory so that ~/.identity is accessible and editable by the user.
3. Forge the home record: As the unprivileged user, use jq to modify ~/.identity, adding the target privileged group (e.g., sudo or wheel) to the memberOf field and incrementing lastChangeUSec by at least 1 to ensure the embedded record wins reconciliation:

   jq '.memberOf = ["sudo"] | .lastChangeUSec = (.lastChangeUSec + 3600000000)' \
     ~/.identity > ~/.identity.new && mv -f ~/.identity.new ~/.identity && chmod 600 ~/.identity

4. Trigger adoption: Run homectl authenticate <username> and supply the user's real password. This invokes the vulnerable home_authenticating_finish() handler, which adopts the forged record into homed's in-memory state without signature verification and persists it via home_save_record().
5. Verify group injection: Confirm the forged membership is now served by NSS: id <username> should show the injected group (e.g., sudo).
6. Escalate to root: Start a fresh login session (e.g., su - <username>) to trigger initgroups(), which picks up the injected supplementary GID. Then run sudo id to obtain a root shell (GitHub Advisory).

• File System: Unexpected modification timestamp on a homed user's ~/.identity file (especially if lastChangeUSec is far ahead of the system clock); memberOf field in ~/.identity containing privileged groups (sudo, wheel, docker, disk, shadow) not authorized by an administrator.
• Logs: journalctl -u systemd-homed entries showing home_authenticating_finish adopting a record for a user followed by home_save_record persisting it; absence of a corresponding home_verify_user_record log entry on the authenticate path (on patched systems, a failed verification would appear instead).
• Process/Command: Execution of homectl authenticate <username> by the account owner (rather than an administrator), particularly outside of normal login flows; subsequent su - or new login session by the same user shortly after.
• Identity DB: Output of id <username> or getent group sudo showing a homed-managed user as a member of a privileged group that was not administratively granted; homectl inspect <username> showing unexpected Member Of entries (GitHub Advisory).

Upgrade systemd to one of the patched versions: 262, 261.2, 260.4, 259.8, or 258.10, which add home_verify_user_record() to the home_authenticating_finish() handler before adopting any worker-returned record. Ubuntu has released a security notice (USN-8626-1) with updated packages. As an immediate workaround where patching is not possible, the advisory recommends removing privileged system groups (e.g., sudo, wheel) from the system, which eliminates the escalation target even if group injection succeeds. Organizations should also audit homectl inspect output for all homed-managed users to detect any already-injected group memberships (GitHub Advisory, Ubuntu Advisory).

The vulnerability was reported by researcher logical-misha and published by bluca (a systemd maintainer) via the GitHub Security Advisory program on August 10, 2026. Ubuntu promptly issued security notice USN-8626-1, and the issue was picked up by Linux security aggregators including LinuxSecurity.com and AusCERT (ESB-2026.9311). The advisory itself notes that the homed codebase already contained a comment in user_record_self_changes_allowed() describing the memberOf: ["wheel"] self-escalation risk on the update path, indicating the threat model was understood but the authenticate path was overlooked (GitHub Advisory, Ubuntu Advisory).