Описание
Security update for systemd
This update for systemd fixes the following issues:
- CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
- CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
- udev: check for invalid chars in various fields received from the kernel (bsc#1259697).
Changelog:
- a943e3ce2f machined: reject invalid class types when registering machines
- 71593f77db udev: fix review mixup
- 73a89810b4 udev-builtin-net-id: print cescaped bad attributes
- 0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
- 40905232e2 udev: ensure tag parsing stays within bounds
- 7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
- d018ac1ea3 udev: check for invalid chars in various fields received from the kernel
- aef6e11921 core/cgroup: avoid one unnecessary strjoina()
- cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
- 26a748f727 core: validate input cgroup path more prudently
- 99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs
Список пакетов
Container bci/bci-init:latest
Container bci/gcc:latest
Container bci/golang:1.25
Container bci/golang:1.25-openssl
Container bci/golang:latest
Container bci/node:22
Container bci/openjdk:17
Container bci/openjdk:21
Container bci/openjdk:latest
Container bci/php-apache:latest
Container bci/php-fpm:latest
Container bci/python:3
Container bci/python:latest
Container bci/ruby:2
Container bci/ruby:latest
Container bci/spack:latest
Container suse/389-ds:latest
Container suse/cosign:latest
Container suse/git:latest
Container suse/kiosk/firefox-esr:latest
Container suse/kiosk/pulseaudio:latest
Container suse/kiosk/xorg-client:latest
Container suse/kiosk/xorg:latest
Container suse/ltss/sle15.6/sle15:latest
Container suse/manager/5.0/x86_64/proxy-httpd:latest
Container suse/manager/5.0/x86_64/proxy-salt-broker:latest
Container suse/manager/5.0/x86_64/proxy-ssh:latest
Container suse/manager/5.0/x86_64/server-attestation:latest
Container suse/manager/5.0/x86_64/server-hub-xmlrpc-api:latest
Container suse/manager/5.0/x86_64/server-migration-14-16:latest
Container suse/manager/5.0/x86_64/server:latest
Container suse/mariadb:latest
Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:latest
Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:latest
Container suse/multi-linux-manager/5.1/x86_64/proxy-ssh:latest
Container suse/multi-linux-manager/5.1/x86_64/server-attestation:latest
Container suse/multi-linux-manager/5.1/x86_64/server-hub-xmlrpc-api:latest
Container suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:latest
Container suse/multi-linux-manager/5.1/x86_64/server-saline:latest
Container suse/multi-linux-manager/5.1/x86_64/server:latest
Container suse/pcp:latest
Container suse/postgres:16
Container suse/postgres:16.14
Container suse/postgres:17
Container suse/postgres:17.10
Container suse/postgres:latest
Container suse/rmt-server:latest
Container suse/samba-client:latest
Container suse/samba-server:latest
Container suse/samba-toolbox:latest
Container suse/sle15:latest
Container suse/valkey:latest
Container third-party/nvidia/driver:550-sles15.7
Container third-party/nvidia/driver:550.163.01-sles15.7
Container third-party/nvidia/driver:570-sles15.7
Container third-party/nvidia/driver:570.195.03-sles15.7
Container third-party/nvidia/driver:570.211.01-sles15.7
Container third-party/nvidia/driver:575-sles15.7
Container third-party/nvidia/driver:575.57.08-sles15.7
Container third-party/nvidia/driver:580-sles15.7
Container third-party/nvidia/driver:580.105.08-sles15.7
Container third-party/nvidia/driver:580.126.09-sles15.7
Container third-party/nvidia/driver:580.126.16-sles15.7
Container third-party/nvidia/driver:580.126.20-sles15.7
Container third-party/nvidia/driver:580.82.07-sles15.7
Container third-party/nvidia/driver:580.95.05-sles15.7
Container third-party/nvidia/driver:590-sles15.7
Container third-party/nvidia/driver:590.48.01-sles15.7
Container third-party/nvidia/driver:595-sles15.7
Container third-party/nvidia/driver:595.45.04-sles15.7
Container third-party/nvidia/driver:595.58.03-sles15.7
Container trento/trento-wanda:latest
Container trento/trento-web:latest
Image SLES15-SP6
Image SLES15-SP6-Azure-3P
Image SLES15-SP6-Azure-Basic
Image SLES15-SP6-Azure-Standard
Image SLES15-SP6-BYOS
Image SLES15-SP6-BYOS-Azure
Image SLES15-SP6-BYOS-EC2
Image SLES15-SP6-BYOS-GCE
Image SLES15-SP6-CHOST-BYOS
Image SLES15-SP6-CHOST-BYOS-Aliyun
Image SLES15-SP6-CHOST-BYOS-Azure
Image SLES15-SP6-CHOST-BYOS-EC2
Image SLES15-SP6-CHOST-BYOS-GCE
Image SLES15-SP6-CHOST-BYOS-GDC
Image SLES15-SP6-CHOST-BYOS-SAP-CCloud
Image SLES15-SP6-EC2
Image SLES15-SP6-EC2-ECS-HVM
Image SLES15-SP6-GCE
Image SLES15-SP6-HPC
Image SLES15-SP6-HPC-Azure
Image SLES15-SP6-HPC-BYOS
Image SLES15-SP6-HPC-BYOS-Azure
Image SLES15-SP6-HPC-BYOS-EC2
Image SLES15-SP6-HPC-BYOS-GCE
Image SLES15-SP6-HPC-EC2
Image SLES15-SP6-HPC-GCE
Image SLES15-SP6-Hardened-BYOS
Image SLES15-SP6-Hardened-BYOS-Azure
Image SLES15-SP6-Hardened-BYOS-EC2
Image SLES15-SP6-Hardened-BYOS-GCE
Image SLES15-SP6-SAP
Image SLES15-SP6-SAP-Azure
Image SLES15-SP6-SAP-Azure-3P
Image SLES15-SP6-SAP-Azure-LI-BYOS
Image SLES15-SP6-SAP-Azure-LI-BYOS-Production
Image SLES15-SP6-SAP-Azure-VLI-BYOS
Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP6-SAP-BYOS
Image SLES15-SP6-SAP-BYOS-Azure
Image SLES15-SP6-SAP-BYOS-EC2
Image SLES15-SP6-SAP-BYOS-GCE
Image SLES15-SP6-SAP-EC2
Image SLES15-SP6-SAP-GCE
Image SLES15-SP6-SAP-Hardened
Image SLES15-SP6-SAP-Hardened-Azure
Image SLES15-SP6-SAP-Hardened-BYOS
Image SLES15-SP6-SAP-Hardened-BYOS-Azure
Image SLES15-SP6-SAP-Hardened-BYOS-EC2
Image SLES15-SP6-SAP-Hardened-BYOS-GCE
Image SLES15-SP6-SAP-Hardened-EC2
Image SLES15-SP6-SAP-Hardened-GCE
Image SLES15-SP6-SAPCAL
Image SLES15-SP6-SAPCAL-Azure
Image SLES15-SP6-SAPCAL-EC2
Image SLES15-SP6-SAPCAL-GCE
Image SLES15-SP7-Azure-3P
Image SLES15-SP7-Azure-Basic
Image SLES15-SP7-Azure-Standard
Image SLES15-SP7-BYOS-Azure
Image SLES15-SP7-BYOS-EC2
Image SLES15-SP7-BYOS-GCE
Image SLES15-SP7-CHOST-BYOS-Aliyun
Image SLES15-SP7-CHOST-BYOS-Azure
Image SLES15-SP7-CHOST-BYOS-EC2
Image SLES15-SP7-CHOST-BYOS-GCE
Image SLES15-SP7-CHOST-BYOS-GDC
Image SLES15-SP7-CHOST-BYOS-SAP-CCloud
Image SLES15-SP7-EC2
Image SLES15-SP7-EC2-ECS-HVM
Image SLES15-SP7-GCE
Image SLES15-SP7-GCE-3P
Image SLES15-SP7-HPC-Azure
Image SLES15-SP7-HPC-BYOS-Azure
Image SLES15-SP7-HPC-BYOS-EC2
Image SLES15-SP7-HPC-BYOS-GCE
Image SLES15-SP7-Hardened-BYOS-Azure
Image SLES15-SP7-Hardened-BYOS-EC2
Image SLES15-SP7-Hardened-BYOS-GCE
Image SLES15-SP7-SAP-Azure
Image SLES15-SP7-SAP-Azure-3P
Image SLES15-SP7-SAP-Azure-LI-BYOS-Production
Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP7-SAP-BYOS-Azure
Image SLES15-SP7-SAP-BYOS-EC2
Image SLES15-SP7-SAP-BYOS-GCE
Image SLES15-SP7-SAP-EC2
Image SLES15-SP7-SAP-GCE
Image SLES15-SP7-SAP-GCE-3P
Image SLES15-SP7-SAP-Hardened-Azure
Image SLES15-SP7-SAP-Hardened-BYOS-Azure
Image SLES15-SP7-SAP-Hardened-BYOS-EC2
Image SLES15-SP7-SAP-Hardened-BYOS-GCE
Image SLES15-SP7-SAP-Hardened-GCE
Image SLES15-SP7-SAPCAL-Azure
Image SLES15-SP7-SAPCAL-EC2
Image SLES15-SP7-SAPCAL-GCE
Image proxy-httpd-image
Image proxy-salt-broker-image
Image proxy-ssh-image
Image server-attestation-image
Image server-database-migration-image
Image server-hub-xmlrpc-api-image
Image server-image
Image server-image-sles15sp7
Image server-saline-image
SUSE Linux Enterprise Module for Basesystem 15 SP7
SUSE Linux Enterprise Module for Package Hub 15 SP7
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP6
openSUSE Leap 15.6
Ссылки
- Link for SUSE-SU-2026:1040-1
- E-Mail link for SUSE-SU-2026:1040-1
- SUSE Security Ratings
- SUSE Bug 1259418
- SUSE Bug 1259650
- SUSE Bug 1259697
- SUSE CVE CVE-2026-29111 page
- SUSE CVE CVE-2026-4105 page
Описание
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.
Затронутые продукты
Ссылки
- CVE-2026-29111
- SUSE Bug 1259418
Описание
A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.
Затронутые продукты
Ссылки
- CVE-2026-4105
- SUSE Bug 1259650
- SUSE Bug 1265554