CVE-2026-40224: 
NixOS vulnerability analysis and mitigation

CVE-2026-40224 is a local privilege escalation vulnerability in systemd-machined affecting systemd versions 259 through 259.x (before 259.3 or 260). The flaw allows an unprivileged user logged into a desktop graphical session to escalate to root by abusing the varlink IPC mechanism to reach the root namespace. It was originally reported via YesWeHack (YWH-PGM9780-96), published on April 10, 2026, and patched in systemd v260 and v259.3. The CVSS v3.1 base score is 6.7 (Moderate), per the official advisory (GitHub Advisory, GHSA-jf3x-2pf6-c45w, Red Hat Bugzilla).

The root cause is classified as CWE-863 (Incorrect Authorization) and CWE-266 (Incorrect Privilege Assignment): systemd-machined fails to properly enforce authorization checks on varlink IPC calls, allowing a low-privileged caller to invoke the org.freedesktop.machine1.register-machine action and reach the root namespace (GitHub Advisory, GHSA-jf3x-2pf6-c45w). Exploitation requires the attacker to be logged into an active desktop graphical session (terminal-only or remote sessions such as SSH are not affected), have low-level local privileges, and trigger some user interaction. Versions older than v259 are not affected, and systemd-machined is typically not installed by default — it is usually part of an optional package such as systemd-container (GitHub Advisory).

Successful exploitation allows a low-privileged user in a graphical desktop session to fully escalate to root, granting complete control over the affected system. This includes the ability to read, modify, or delete sensitive data, install malicious software, create backdoors, and disrupt system availability. The scope is limited to the local system (no scope change), but the confidentiality, integrity, and availability impacts are all rated High (GitHub Advisory, GHSA-jf3x-2pf6-c45w).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.014% (3rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for a local graphical desktop session and user interaction, which limits the attack surface (GHSA-jf3x-2pf6-c45w).

1. Precondition check: Confirm the target system is running systemd version 259.x (before 259.3) with systemd-machined installed (e.g., via the systemd-container package) and that the attacker has access to an active desktop graphical session.
2. Identify varlink socket: Locate the varlink socket exposed by systemd-machined, typically at /run/systemd/machine/io.systemd.Machine or similar path accessible from the user session.
3. Craft varlink IPC call: Construct a varlink protocol message targeting the org.freedesktop.machine1.register-machine method, which lacks proper authorization enforcement in the vulnerable versions.
4. Invoke privileged operation: Send the crafted varlink call from the unprivileged user context; due to the missing authorization check, systemd-machined processes the request in the root namespace without requiring admin credentials.
5. Achieve root access: Leverage the root namespace access obtained through the IPC call to execute commands or spawn processes with root privileges, completing the privilege escalation (GitHub Advisory).

• Logs: Unexpected or repeated calls to org.freedesktop.machine1.register-machine in systemd journal logs (journalctl -u systemd-machined) from non-root, non-privileged users; Polkit authorization log entries showing approved machine registration actions for unprivileged users.
• Process: Unusual processes spawned with root privileges from a desktop user session; unexpected child processes of systemd-machined running as root.
• File System: New or modified files in privileged directories (e.g., /etc, /root, /usr) created by a non-root user account; unexpected cron jobs, SSH authorized keys, or SUID binaries added post-exploitation.
• Network: Outbound connections from the compromised host to unknown external IPs initiated shortly after a graphical session login event (indicative of post-exploitation activity).

The primary remediation is to upgrade systemd to version 260 or 259.3, both of which contain the fix (commits e5a5656 for v260 and 90b7cb9 for v259.3) (GitHub Advisory). As a workaround where immediate patching is not possible, restrict access to the register-machine Polkit action by creating /etc/polkit-1/rules.d/machined-register.rules with the following content:

polkit.addRule(function(action, subject) {
  if (action.id == "org.freedesktop.machine1.register-machine" &&
      subject.user != "root") {
    return polkit.Result.AUTH_ADMIN_KEEP;
  }
});

Additionally, if systemd-machined (typically in the systemd-container package) is not required, removing or disabling it eliminates the attack surface entirely (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was originally reported through the YesWeHack bug bounty platform (reference YWH-PGM9780-96) and disclosed by systemd maintainer bluca via a GitHub Security Advisory (GitHub Advisory). Red Hat opened a tracking bug (Bugzilla #2457325) and assigned it medium priority/severity, reflecting the constrained exploitation conditions (Red Hat Bugzilla). Broader community reaction has been limited given the moderate severity rating and the fact that systemd-machined is not installed by default on most systems.