CVE-2026-4105: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-4105 is a local privilege escalation vulnerability in systemd-machined caused by improper access control (CWE-284) in the RegisterMachine D-Bus method. An unprivileged local user logged into a desktop graphical session can exploit insufficient validation of the class parameter to leave behind an attacker-controlled machine object, then invoke privileged methods on it to execute arbitrary commands as root. The vulnerability affects systemd versions >= v259 (and v225+ with a custom polkit policy granting register-machine access); versions prior to v259 are not affected under default configurations. It was disclosed on March 13, 2026, with a CVSS v3.1 base score of 6.7 (Medium) per the GitHub Security Advisory, and 7.8 (High) per ENISA's scoring (GitHub Advisory, Red Hat CVE, Red Hat Bugzilla).

The root cause is CWE-284 (Improper Access Control): systemd-machined fails to adequately validate the class parameter supplied to the RegisterMachine D-Bus method, allowing an unprivileged caller to register a machine object with a crafted class value (GitHub Advisory). When the registration attempt fails or is partially processed, a usable, attacker-controlled machine object may persist in the service's state. The attacker can then invoke privileged D-Bus methods on this object, achieving root-level command execution on the host (Red Hat Bugzilla). Exploitation requires the attacker to be a low-privileged user in an active desktop graphical session; terminal-only or remote (e.g., SSH) sessions are not affected. The vulnerability is unrelated to systemd's PID 1 service manager. Patched commits are available: v260 (6df5f80) and v259.4 (497d017) (GitHub Advisory).

Successful exploitation grants a local unprivileged user full root privileges on the affected host, resulting in complete compromise of confidentiality, integrity, and availability. An attacker can read sensitive files, modify system configuration, install rootkits or persistent backdoors, and potentially pivot to other systems or containers managed by the host. The scope is limited to the local system (Scope: Unchanged), but the impact on all three security pillars is rated High (GitHub Advisory, Red Hat CVE).

A proof-of-concept reference is listed at exploit-intel.com, and a technical blog post describing the privilege escalation technique was published shortly after disclosure (Feedly). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.015% (0.000150), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available in Nessus (IDs: 302156, 303575, 305859) and Qualys (IDs: 288272, 6275254) (Feedly).

1. Reconnaissance: Confirm the target system is running systemd-machined >= v259 (or v225+ with a permissive polkit policy) and that you have access to an active desktop graphical session (not SSH or terminal-only).
2. Identify D-Bus interface: Use busctl or gdbus to enumerate the org.freedesktop.machine1 D-Bus service and confirm the RegisterMachine method is accessible.
3. Craft malicious RegisterMachine call: Invoke the RegisterMachine D-Bus method with a specially crafted class parameter value that bypasses input validation, e.g., using busctl call org.freedesktop.machine1 /org/freedesktop/machine1 org.freedesktop.machine1.Manager RegisterMachine ... with the crafted class argument.
4. Persist attacker-controlled object: The failed or partial registration leaves behind a usable machine object in systemd-machined's state that is under attacker control.
5. Invoke privileged methods: Call privileged D-Bus methods on the attacker-controlled machine object to execute arbitrary commands with root privileges on the host system.
6. Achieve root access: Use the root command execution to establish persistence, exfiltrate data, or perform further lateral movement (GitHub Advisory, Red Hat Bugzilla).

• Logs: Unusual D-Bus activity in system logs (journalctl -u systemd-machined) involving RegisterMachine calls from non-root, non-container-management users; unexpected polkit authorization requests for org.freedesktop.machine1.register-machine.
• Process: Unexpected privileged processes (e.g., shells, package managers) spawned as root from a non-root user's desktop session; unusual child processes of systemd-machined.
• File System: New or modified files in sensitive directories (e.g., /etc/sudoers.d/, /root/.ssh/, /etc/cron.d/) created around the time of suspicious D-Bus activity; new systemd unit files or polkit rules not associated with legitimate administration.
• Network: Outbound connections from the host to unknown external IPs initiated shortly after suspicious D-Bus method calls, potentially indicating post-exploitation activity.

Upgrade systemd to v260 or v259.4, which contain the official patches (6df5f80 and 497d017 respectively) (GitHub Advisory). Red Hat has issued security errata (RHSA-2026:7299) for affected Red Hat Enterprise Linux systems, and patches are available for Fedora, SUSE, openSUSE, and Debian (Red Hat Errata, Feedly). As a workaround where patching is not immediately possible, restrict access to the register-machine polkit action by creating /etc/polkit-1/rules.d/machined-register.rules with the following content to require admin authentication for non-root users:

polkit.addRule(function(action, subject) {
  if (action.id == "org.freedesktop.machine1.register-machine" &&
      subject.user != "root") {
    return polkit.Result.AUTH_ADMIN_KEEP;
  }
});

Additionally, if systemd-machined (often in the systemd-container package) is not required, consider removing or disabling it to eliminate the attack surface entirely (GitHub Advisory).

The vulnerability was reported by researcher manizada and disclosed via the systemd GitHub Security Advisory on March 12–13, 2026 (GitHub Advisory). Red Hat, SUSE, Fedora, Debian, and openSUSE all issued security advisories and patches within weeks of disclosure, reflecting broad industry attention to the issue (Red Hat Errata, Feedly). German Linux security outlet pro-linux.de published multiple follow-up articles tracking patch availability across distributions. Community discussion noted that the attack surface is limited by the requirement for a graphical desktop session and the fact that systemd-machined is not installed by default on most systems.