Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

oracle-oval логотип

ELSA-2026-13677

Опубликовано: 05 мая 2026
Источник: oracle-oval
Платформа: Oracle Linux 9

Описание

ELSA-2026-13677: systemd security update (MODERATE)

[252-55.0.3.el9_7.9]

  • serialize: don't allocate 1M on the stack just like that [LINUX-16166]
  • Route logs from container mapped uids to the system journal [Orabug: 38135007]
  • Drop delay when nspawn fails to reset loginuid [Orabug: 37793135]
  • Improve logging for api bus connection and subscribers [Orabug: 38040980]
  • Defer processing of timeout events in sd-bus api [Orabug: 38064217]
  • coredump: use %d in kernel core pattern - CVE-2025-4598
  • Add bus description to sd-bus outgoing sockets [Orabug: 37347576]
  • Add log messages about daemon-reload requester and duration [Orabug: 37347576]
  • Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved.
  • drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224]
  • 1A) Fix local-fs and remote-fs targets during system boot (replaces old Orabug: 25897792) [Orabug: 36269319]
  • 1B) Add 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319]
  • 1C) Add required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319]
  • 1D) Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]
  • Due to a new [Orabug: 36564551] filed on April 29 2024, reverting from back to
  • previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved.
  • drop IN_ATTRIB from parent directory inotify watches [Orabug: 37118224]
  • Reverted back to previous Tony Lam patch [Orabug: 25897792] until issue with [Orabug: 36564551] is resolved.
  • Re-Added 1001-Fix-missing-netdev-for-iscsi-entry-in-fstab.patch [Orabug: 25897792]
  • Backport upstream pstore dmesg fix [Orabug: 34868110]
  • Remove upstream references [Orabug: 33995357]
  • Disable unprivileged BPF by default [Orabug: 32870980]
  • udev rules: fix memory hot add and remove [Orabug: 31310273]
  • set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874]
  • allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469]
  • shutdown: get only active md arrays. [Orabug: 34467234]
  • Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407]
  • Removed unneeded patches from the systemd.spec
  • 1A) 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490]
  • 1B) 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490]
  • 1C) 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110]
  • Removed the following, associated with [Orabug: 36269319]:
  • 2A) Remove 1001-systemd-fstab-generator-reload-targets.patch
  • 2B) Remove Fix local-fs and remote-fs targets during system boot [Orabug: 36269319]
  • 2C) Remove 'systemd-fstab-generator-reload-targets.service' file [Orabug: 36269319]
  • 2D) Remove required rpms for correct kickstart/systemd functionality within systemd.spec [Orabug: 36269319]
  • 2E) Remove Important: Review 1001-systemd-fstab-generator-reload-targets.patch for important build details/steps [Orabug: 36269319]

[252-55.9]

  • core: validate input cgroup path more prudently (RHEL-155391)

Обновленные пакеты

Oracle Linux 9

Oracle Linux aarch64

systemd-boot-unsigned

252-55.0.3.el9_7.9

systemd-devel

252-55.0.3.el9_7.9

systemd-journal-remote

252-55.0.3.el9_7.9

systemd-ukify

252-55.0.3.el9_7.9

rhel-net-naming-sysattrs

252-55.0.3.el9_7.9

systemd

252-55.0.3.el9_7.9

systemd-container

252-55.0.3.el9_7.9

systemd-libs

252-55.0.3.el9_7.9

systemd-oomd

252-55.0.3.el9_7.9

systemd-pam

252-55.0.3.el9_7.9

systemd-resolved

252-55.0.3.el9_7.9

systemd-rpm-macros

252-55.0.3.el9_7.9

systemd-udev

252-55.0.3.el9_7.9

Oracle Linux x86_64

rhel-net-naming-sysattrs

252-55.0.3.el9_7.9

systemd

252-55.0.3.el9_7.9

systemd-container

252-55.0.3.el9_7.9

systemd-libs

252-55.0.3.el9_7.9

systemd-oomd

252-55.0.3.el9_7.9

systemd-pam

252-55.0.3.el9_7.9

systemd-resolved

252-55.0.3.el9_7.9

systemd-rpm-macros

252-55.0.3.el9_7.9

systemd-udev

252-55.0.3.el9_7.9

systemd-devel

252-55.0.3.el9_7.9

systemd-journal-remote

252-55.0.3.el9_7.9

systemd-ukify

252-55.0.3.el9_7.9

systemd-boot-unsigned

252-55.0.3.el9_7.9

Связанные CVE

Связанные уязвимости

CVSS3: 5.5
ubuntu
4 месяца назад

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

CVSS3: 7.8
redhat
4 месяца назад

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

CVSS3: 5.5
nvd
4 месяца назад

systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.

CVSS3: 5.5
msrc
4 месяца назад

systemd: Local unprivileged user can trigger an assert

CVSS3: 5.5
debian
4 месяца назад

systemd, a system and service manager, (as PID 1) hits an assert and f ...