CVE-2026-40226
systemd-standalone-tmpfiles: In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.
CVE-2026-40226 is fixed in 30 products on 1 platform, first by libnss-myhostname 249.11-0ubuntu3.21, released April 10, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
6.4
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0008
0th percentile
In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libnss-myhostname · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | libnss-myhostname 249.11-0ubuntu3.21 | Apr 10, 2026 |
| libnss-myhostname · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | libnss-myhostname 255.4-1ubuntu8.16 | Apr 10, 2026 |
| libnss-myhostname · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | libnss-myhostname 257.9-0ubuntu2.5 | Apr 10, 2026 |
| libnss-mymachines · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | libnss-mymachines 249.11-0ubuntu3.21 | Apr 10, 2026 |
| libnss-mymachines · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | libnss-mymachines 255.4-1ubuntu8.16 | Apr 10, 2026 |
| libnss-mymachines · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | libnss-mymachines 257.9-0ubuntu2.5 | Apr 10, 2026 |
| libnss-resolve · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | libnss-resolve 249.11-0ubuntu3.21 | Apr 10, 2026 |
| libnss-resolve · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | libnss-resolve 255.4-1ubuntu8.16 | Apr 10, 2026 |
| libnss-resolve · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | libnss-resolve 257.9-0ubuntu2.5 | Apr 10, 2026 |
| libnss-systemd · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | libnss-systemd 249.11-0ubuntu3.21 | Apr 10, 2026 |
| libnss-systemd · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | libnss-systemd 255.4-1ubuntu8.16 | Apr 10, 2026 |
| libnss-systemd · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | libnss-systemd 257.9-0ubuntu2.5 | Apr 10, 2026 |
| libpam-systemd · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | libpam-systemd 249.11-0ubuntu3.21 | Apr 10, 2026 |
| libpam-systemd · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | libpam-systemd 255.4-1ubuntu8.16 | Apr 10, 2026 |
| libpam-systemd · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | libpam-systemd 257.9-0ubuntu2.5 | Apr 10, 2026 |
| libsystemd-shared · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | libsystemd-shared 255.4-1ubuntu8.16 | Apr 10, 2026 |
| libsystemd-shared · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | libsystemd-shared 257.9-0ubuntu2.5 | Apr 10, 2026 |
| libsystemd0 · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | libsystemd0 249.11-0ubuntu3.21 | Apr 10, 2026 |
| libsystemd0 · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | libsystemd0 255.4-1ubuntu8.16 | Apr 10, 2026 |
| libsystemd0 · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | libsystemd0 257.9-0ubuntu2.5 | Apr 10, 2026 |
| libudev1 · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | libudev1 249.11-0ubuntu3.21 | Apr 10, 2026 |
| libudev1 · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | libudev1 255.4-1ubuntu8.16 | Apr 10, 2026 |
| libudev1 · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | libudev1 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd · Debian 12.15 (bookworm) | 252.39-1~deb12u2 | DEBIAN-CVE-2026-40226 | Apr 10, 2026 |
| systemd · Debian 13.5 (trixie) | 257.13-1~deb13u1 | DEBIAN-CVE-2026-40226 | Apr 10, 2026 |
| systemd · Debian 14 | 260~rc3-1 | DEBIAN-CVE-2026-40226 | Apr 10, 2026 |
| systemd · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | systemd 249.11-0ubuntu3.21 | Apr 10, 2026 |
| systemd · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd · opensuse-leap 16.0 | 257.13-160000.4.1 | OPENSUSE-SU-2026:21754-1 | Sep 3, 2026 |
| systemd · sles 15.7 | 254.27-150600.4.71.2 | SUSE-SU-2026:3244-1 | Jul 24, 2026 |
| systemd · sles 16.0 | 257.13-160000.4.1 | SUSE-SU-2026:23620-1 | Sep 3, 2026 |
| systemd-boot · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-boot 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-boot · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-boot 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-boot-efi · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-boot-efi 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-boot-efi · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-boot-efi 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-boot-tools · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-boot-tools 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-container · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | systemd-container 249.11-0ubuntu3.21 | Apr 10, 2026 |
| systemd-container · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-container 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-container · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-container 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-coredump · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | systemd-coredump 249.11-0ubuntu3.21 | Apr 10, 2026 |
| systemd-coredump · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-coredump 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-coredump · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-coredump 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-cryptsetup · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-cryptsetup 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-homed · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-homed 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-homed · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-homed 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-journal-remote · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | systemd-journal-remote 249.11-0ubuntu3.21 | Apr 10, 2026 |
| systemd-journal-remote · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-journal-remote 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-journal-remote · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-journal-remote 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-mini · opensuse-leap 16.0 | 257.13-160000.4.1 | OPENSUSE-SU-2026:21754-1 | Sep 3, 2026 |
| systemd-oomd · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | systemd-oomd 249.11-0ubuntu3.21 | Apr 10, 2026 |
| systemd-oomd · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-oomd 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-oomd · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-oomd 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-repart · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | systemd-repart 249.11-0ubuntu3.21 | Apr 10, 2026 |
| systemd-repart · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-repart 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-resolved · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-resolved 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-resolved · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-resolved 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-standalone-shutdown · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-standalone-shutdown 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-standalone-sysusers · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | systemd-standalone-sysusers 249.11-0ubuntu3.21 | Apr 10, 2026 |
| systemd-standalone-sysusers · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-standalone-sysusers 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-standalone-sysusers · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-standalone-sysusers 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-standalone-tmpfiles · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | systemd-standalone-tmpfiles 249.11-0ubuntu3.21 | Apr 10, 2026 |
| systemd-standalone-tmpfiles · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-standalone-tmpfiles 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-standalone-tmpfiles · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-standalone-tmpfiles 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-sysv · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | systemd-sysv 249.11-0ubuntu3.21 | Apr 10, 2026 |
| systemd-sysv · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-sysv 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-sysv · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-sysv 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-tests · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | systemd-tests 249.11-0ubuntu3.21 | Apr 10, 2026 |
| systemd-tests · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-tests 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-tests · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-tests 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-timesyncd · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | systemd-timesyncd 249.11-0ubuntu3.21 | Apr 10, 2026 |
| systemd-timesyncd · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-timesyncd 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-timesyncd · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-timesyncd 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-ukify · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-ukify 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-ukify · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-ukify 257.9-0ubuntu2.5 | Apr 10, 2026 |
| systemd-userdbd · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | systemd-userdbd 255.4-1ubuntu8.16 | Apr 10, 2026 |
| systemd-userdbd · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | systemd-userdbd 257.9-0ubuntu2.5 | Apr 10, 2026 |
| udev · Ubuntu 22.04.1 LTS (jammy) | 249.11-0ubuntu3.21 | udev 249.11-0ubuntu3.21 | Apr 10, 2026 |
| udev · Ubuntu 24.04.5 LTS (noble) | 255.4-1ubuntu8.16 | udev 255.4-1ubuntu8.16 | Apr 10, 2026 |
| udev · Ubuntu 25.10 (questing) | 257.9-0ubuntu2.5 | udev 257.9-0ubuntu2.5 | Apr 10, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.