CVE-2026-40226: 
NixOS vulnerability analysis and mitigation

CVE-2026-40226 is a container escape vulnerability in systemd-nspawn that allows an attacker with high privileges to break out of the container environment and execute code on the host system via a crafted optional configuration file. It affects systemd versions 233 through 259 (before 260), with fixed backport releases at 257.12, 258.6, and 259.4. The vulnerability was published on April 10, 2026, and was originally reported via the YesWeHack bug bounty platform (YWH-PGM9780-116). It carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, systemd Advisory).

The root cause is classified as CWE-348 (Use of Less Trusted Source): systemd-nspawn optionally reads configuration files that can be downloaded alongside container images and stored in privileged directories. Two parsing bugs affect the handling of the PivotRoot=, BindUser=, and Ephemeral= options in these .nspawn config files. When a malformed or crafted config file is processed, the container is spawned on the host's root filesystem instead of the container image, effectively bypassing container isolation with high privileges. Exploitation requires local access and high privileges (e.g., the ability to place or influence a .nspawn config file in a directory automatically scanned by nspawn), making the attack complexity high (systemd Advisory, Red Hat Bugzilla).

Successful exploitation allows a high-privileged attacker to escape the systemd-nspawn container and gain access to the host root filesystem with elevated privileges. This results in high impact to confidentiality, integrity, and availability of the host system — an attacker could read sensitive host data, modify system files, disrupt services, or use the host as a pivot point for further lateral movement within the infrastructure (systemd Advisory, GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.006% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for local access and high privileges, significantly limiting the attacker pool (GitHub Advisory, systemd Advisory).

1. Gain high-privileged local access: Obtain root or equivalent privileges on a system running systemd-nspawn with a vulnerable systemd version (233–259 before the respective patch releases).
2. Identify nspawn config directory: Locate the directory from which nspawn automatically loads .nspawn configuration files (e.g., /etc/systemd/nspawn/ or alongside the container image).
3. Craft malicious config file: Create or modify a .nspawn config file to include malformed values for PivotRoot=, BindUser=, or Ephemeral= options that trigger the parsing bug.
4. Trigger container spawn: Launch or restart the target nspawn container so that the malicious config file is parsed by the vulnerable nspawn code.
5. Achieve host escape: Due to the parsing bug, the container is spawned on the host root filesystem instead of the container image, granting the attacker access to the host environment with high privileges (systemd Advisory).

• File System: Unexpected or recently modified .nspawn configuration files in /etc/systemd/nspawn/ or container image directories, particularly those containing PivotRoot=, BindUser=, or Ephemeral= directives with unusual or empty values.
• Logs: systemd journal entries showing nspawn containers starting with unexpected root filesystem paths (host rootfs instead of container image path); errors or anomalies in nspawn parsing logs.
• Process: Processes spawned by nspawn that have access to host filesystem paths outside the expected container root; unexpected privileged processes with parent PID traceable to systemd-nspawn.
• File System: New files, scripts, or cron jobs created in host system directories (e.g., /etc/, /root/, /usr/) by processes associated with a container workload.

Upgrade systemd to one of the patched versions: 260, 259.4, 258.6, or 257.12. Debian LTS users should apply the update referenced in the Debian LTS announcement (DLA-4533-1), and Ubuntu users should apply USN-8402-1. As a workaround where patching is not immediately possible, sanitize nspawn storage directories to ensure no .nspawn config files are present, or verify that any existing config files do not use the PivotRoot=, BindUser=, or Ephemeral= options (systemd Advisory, Red Hat Bugzilla).

The vulnerability received coverage from Linux security news outlets including LinuxSecurity.com (covering both Debian and Ubuntu advisories) and LinuxCompatible.org. Red Hat tracked the issue via Bugzilla and assigned medium severity. The Yocto Project security mailing list also flagged the issue for embedded Linux users. No significant researcher commentary or social media debate has been observed, consistent with the moderate severity and high exploitation complexity of the vulnerability.