CVE-2026-29111: 
NixOS vulnerability analysis and mitigation

CVE-2026-29111 is a vulnerability in systemd (the Linux system and service manager running as PID 1) that allows an unprivileged local user to trigger a denial of service or, on older versions, stack overwriting with attacker-controlled content, by making a malformed IPC API call. The affected IPC call (GetUnitByControlGroup) was introduced in systemd v239, so only versions v239 through v259.1 are affected. On versions v249 and older, the bug results in stack overwriting with attacker-controlled content; on v250 and newer, a safety check converts the condition into an assert that freezes execution. It was publicly disclosed on March 23, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper validation of the cgroup path argument supplied to the GetUnitByControlGroup D-Bus IPC method in src/core/dbus-manager.c (CWE-1287: Improper Validation of Specified Type of Input). An unprivileged local attacker can call this method via the system D-Bus with a malformed or excessively long cgroup path (e.g., a path of 8 million 'A' characters), bypassing path validation checks. On systemd v249 and older, this causes a stack overwrite with attacker-controlled content due to the absence of a safety check; on v250+, the added safety check triggers an assert, causing systemd (PID 1) to freeze. The fix adds explicit path_is_absolute() and path_is_normalized() validation before processing the cgroup path argument (GitHub Advisory, Patch Commit). The vulnerability was originally reported on YesWeHack as #YWH-PGM9780-94.

On systemd versions v239–v249, successful exploitation can result in stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution in the context of PID 1 (the system and service manager). On versions v250–v259.1, exploitation causes systemd to hit an assert and freeze, resulting in a complete system denial of service — effectively rendering the host unresponsive. Because systemd runs as PID 1, a freeze or crash affects the entire operating system, impacting all running services and potentially requiring a hard reboot to recover (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires only local access with low privileges and no user interaction, making it relatively easy to trigger once an attacker has a foothold on the system. The EPSS score is approximately 0.01% (0.000100), indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus and Qualys (Feedly).

1. Gain local access: Obtain a low-privileged local user account on a system running systemd v239–v259.1 (e.g., via SSH, a web shell, or another initial access vector).
2. Verify D-Bus access: Confirm that the system D-Bus is accessible and the org.freedesktop.systemd1 service is available (standard on most Linux distributions using systemd).
3. Craft malformed IPC call: Use a D-Bus client library (e.g., pydbus in Python) to call the GetUnitByControlGroup method with a malformed or excessively long cgroup path argument, such as a path consisting of a leading / followed by millions of repeated characters:

   python3 -c 'from pydbus import SystemBus; SystemBus().get("org.freedesktop.systemd1", "/org/freedesktop/systemd1").GetUnitByControlGroup("/" + "A" * 8000000)'

4. Trigger the vulnerability: On v250+, systemd (PID 1) hits an assert and freezes, causing a system-wide denial of service. On v249 and older, the stack is overwritten with attacker-controlled content, potentially enabling code execution.
5. Achieve objective: On newer versions, the system becomes unresponsive and requires a hard reboot. On older versions, further exploitation of the stack overwrite may allow privilege escalation or arbitrary code execution as PID 1 (GitHub Advisory).

• Logs: Sudden absence of systemd journal entries following an unprivileged D-Bus call; kernel panic or system freeze messages in /var/log/syslog or dmesg output; D-Bus audit log entries showing calls to org.freedesktop.systemd1 GetUnitByControlGroup with unusually long or malformed path arguments.
• Process: systemd (PID 1) becoming unresponsive or entering a frozen state; all system services becoming unreachable simultaneously without an apparent hardware cause.
• Network: Unexpected system reboots or loss of SSH/remote access to a host, potentially indicating a triggered denial of service.
• File System: No specific file artifacts are associated with the denial-of-service variant; on older versions (v249 and below), evidence of stack corruption may appear as unexpected crashes or core dumps from PID 1.

Upgrade systemd to one of the patched versions: 257.11, 258.5, 259.2, or 260-rc1 (or any later stable release). No configuration-based workarounds are available — patching is the only mitigation. As a compensating control, restrict local user access to the system D-Bus where operationally feasible to reduce exposure to unprivileged local attackers. IBM has also released updates for affected container products (IBM MQ Operator, IBM App Connect Enterprise Certified Container) (GitHub Advisory, IBM Advisory, Red Hat CVE).

The vulnerability received broad coverage across Linux distribution security channels, with Ubuntu (USN-8119-1, USN-8119-2), Red Hat (RHSA-2026:13651, RHSA-2026:13677, and others), SUSE, Debian, and Oracle Linux all issuing advisories and patched packages. Community discussion on Reddit (r/zorinos) noted the vulnerability alongside CVE-2026-3888, reflecting user concern about systemd's role as PID 1 and the potential for system-wide impact. Linux security news outlets including LinuxSecurity.com and Pro-Linux.de covered the issue, with some framing it as a privilege escalation risk due to the stack overwrite behavior on older versions.