systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29111.json",
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-269"
]
}{
"source": [
"CPE_RANGE",
"REFERENCES"
],
"cpe": "cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*",
"extracted_events": [
{
"introduced": "239"
},
{
"fixed": "257.11"
},
{
"introduced": "258"
},
{
"fixed": "258.5"
},
{
"introduced": "259"
},
{
"fixed": "259.2"
}
]
}
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-29111.json"
"2026-08-18T18:39:13Z"
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"74241627649379572940237871204337248951",
"190248392954225862895046494764330743334",
"10476376812353058515822966104826628091",
"299444070388037751571925535897836317622",
"67599645563402544596169502877860093668",
"283638024774170399550235635902522654178",
"281971283650281598167650463558982248929",
"328120986930651100121905773514333408472",
"200752642364374135539716163744991112600",
"40418862966100084331393520030359755144",
"126156479297765251409707001179404804599",
"219787598027598433146582709437350440079",
"22105943878839436144900831120422026501",
"251097644099395644942048987030205569009",
"322833416182431868758742427212151661100",
"19150824768764388519534178422465828680",
"32785480672360690000447852086927422334",
"53656597144497354460746614333564476997",
"228288372448556391404277616053546092467",
"277184916848163418577271925738216190748",
"135877626244631961077416862034837461873",
"92734782597665648262202764004359833768",
"174627645836422835421248537357311418351",
"7247850072634367808628496207018425300",
"333323204208093190804577075855739419278",
"258184464472823272084302221619355594721",
"82388457489616484475894030477243470797",
"209555804188972931658846269111374425705",
"114850236416424570428484446853650726668",
"287883103823621647030638849570220025457",
"251186095520306058777024465048572394760",
"175989337095032823729906481893962220209",
"325592708495645074815157004598269910556",
"273095542765017909302083232359281815678",
"93891745136410565346317154218152115783",
"224014057259279001218790638713382251921",
"276045700553373743335360493479966401309",
"328493918794516100740086503449710701896"
]
},
"source": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-057705b0",
"signature_type": "Line",
"target": {
"file": "src/core/cgroup.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"12520589164162081752661605274428062866",
"249244184142750633726996238127588624576",
"198969187435743226641358953500574904440"
]
},
"source": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-0e452bcb",
"signature_type": "Line",
"target": {
"file": "src/test/test-path-util.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"128147797591844763431518260556823510692",
"74769570834873134491525299268731630739",
"59722083096788575625187053333268847404",
"254781635205178545317769556620778422467"
]
},
"source": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-164e317b",
"signature_type": "Line",
"target": {
"file": "src/basic/fs-util.c"
}
},
{
"digest": {
"length": 2463.0,
"function_hash": "237503192414755666936241690514586762392"
},
"source": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-219de537",
"signature_type": "Function",
"target": {
"function": "unit_attach_pids_to_cgroup",
"file": "src/core/cgroup.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"237411456297733094785995572106071251187",
"11407254875668297745469999821197244203",
"174767797837654482736044562134851441307",
"205575042834276187160817240824505628207"
]
},
"source": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-27ff4dc0",
"signature_type": "Line",
"target": {
"file": "src/core/varlink-unit.c"
}
},
{
"digest": {
"length": 1415.0,
"function_hash": "227523190924417884295004803507337054632"
},
"source": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-2bb83bb3",
"signature_type": "Function",
"target": {
"function": "unit_attach_pids_to_cgroup",
"file": "src/core/cgroup.c"
}
},
{
"digest": {
"length": 869.0,
"function_hash": "155167571133191932974658116898218518977"
},
"source": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-3fde54d2",
"signature_type": "Function",
"target": {
"function": "unit_attach_pid_to_cgroup_via_bus",
"file": "src/core/cgroup.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"74241627649379572940237871204337248951",
"190248392954225862895046494764330743334",
"10476376812353058515822966104826628091",
"299444070388037751571925535897836317622",
"67599645563402544596169502877860093668",
"283638024774170399550235635902522654178",
"281971283650281598167650463558982248929",
"328120986930651100121905773514333408472",
"200752642364374135539716163744991112600",
"40418862966100084331393520030359755144",
"126156479297765251409707001179404804599",
"219787598027598433146582709437350440079",
"22105943878839436144900831120422026501",
"251097644099395644942048987030205569009",
"322833416182431868758742427212151661100",
"19150824768764388519534178422465828680",
"32785480672360690000447852086927422334",
"53656597144497354460746614333564476997",
"228288372448556391404277616053546092467",
"277184916848163418577271925738216190748",
"135877626244631961077416862034837461873",
"92734782597665648262202764004359833768",
"174627645836422835421248537357311418351",
"7247850072634367808628496207018425300",
"333323204208093190804577075855739419278",
"258184464472823272084302221619355594721",
"82388457489616484475894030477243470797",
"209555804188972931658846269111374425705",
"114850236416424570428484446853650726668",
"287883103823621647030638849570220025457",
"251186095520306058777024465048572394760",
"175989337095032823729906481893962220209",
"325592708495645074815157004598269910556",
"273095542765017909302083232359281815678",
"93891745136410565346317154218152115783",
"224014057259279001218790638713382251921",
"276045700553373743335360493479966401309",
"328493918794516100740086503449710701896"
]
},
"source": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-636a6601",
"signature_type": "Line",
"target": {
"file": "src/core/cgroup.c"
}
},
{
"digest": {
"length": 1415.0,
"function_hash": "227523190924417884295004803507337054632"
},
"source": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-6471bcaf",
"signature_type": "Function",
"target": {
"function": "unit_attach_pids_to_cgroup",
"file": "src/core/cgroup.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"14322566168872439996538943778593744497",
"323788793540457202652726292523796969800",
"282193962428094384190249864300589348919",
"245734431923272990606166987775823057128",
"50162601627712036662417034235585242486",
"54447337188319030907470399833573260089"
]
},
"source": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-6bad4ebd",
"signature_type": "Line",
"target": {
"file": "src/basic/path-util.h"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"74241627649379572940237871204337248951",
"190248392954225862895046494764330743334",
"10476376812353058515822966104826628091",
"299444070388037751571925535897836317622",
"67599645563402544596169502877860093668",
"283638024774170399550235635902522654178",
"281971283650281598167650463558982248929",
"328120986930651100121905773514333408472",
"200752642364374135539716163744991112600",
"40418862966100084331393520030359755144",
"126156479297765251409707001179404804599",
"219787598027598433146582709437350440079",
"22105943878839436144900831120422026501",
"251097644099395644942048987030205569009",
"322833416182431868758742427212151661100",
"19150824768764388519534178422465828680",
"32785480672360690000447852086927422334",
"53656597144497354460746614333564476997",
"228288372448556391404277616053546092467",
"277184916848163418577271925738216190748",
"135877626244631961077416862034837461873",
"92734782597665648262202764004359833768",
"174627645836422835421248537357311418351",
"7247850072634367808628496207018425300",
"333323204208093190804577075855739419278",
"258184464472823272084302221619355594721",
"82388457489616484475894030477243470797",
"209555804188972931658846269111374425705",
"114850236416424570428484446853650726668",
"287883103823621647030638849570220025457",
"251186095520306058777024465048572394760",
"175989337095032823729906481893962220209",
"325592708495645074815157004598269910556",
"273095542765017909302083232359281815678",
"93891745136410565346317154218152115783",
"224014057259279001218790638713382251921",
"276045700553373743335360493479966401309",
"328493918794516100740086503449710701896"
]
},
"source": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-72f4b4e2",
"signature_type": "Line",
"target": {
"file": "src/core/cgroup.c"
}
},
{
"digest": {
"length": 572.0,
"function_hash": "235802219058398686975006562181939174057"
},
"source": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-75e3695c",
"signature_type": "Function",
"target": {
"function": "rmdir_parents",
"file": "src/basic/fs-util.c"
}
},
{
"digest": {
"length": 1260.0,
"function_hash": "20040678889486269314138808756936275054"
},
"source": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-7f317804",
"signature_type": "Function",
"target": {
"function": "lookup_unit_by_parameters",
"file": "src/core/varlink-unit.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"237411456297733094785995572106071251187",
"11407254875668297745469999821197244203",
"174767797837654482736044562134851441307",
"205575042834276187160817240824505628207"
]
},
"source": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-80610f87",
"signature_type": "Line",
"target": {
"file": "src/core/varlink-unit.c"
}
},
{
"digest": {
"length": 869.0,
"function_hash": "155167571133191932974658116898218518977"
},
"source": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-9823c8aa",
"signature_type": "Function",
"target": {
"function": "unit_attach_pid_to_cgroup_via_bus",
"file": "src/core/cgroup.c"
}
},
{
"digest": {
"length": 425.0,
"function_hash": "59195814632473455996912241933457435978"
},
"source": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-a49dec07",
"signature_type": "Function",
"target": {
"function": "method_get_unit_by_control_group",
"file": "src/core/dbus-manager.c"
}
},
{
"digest": {
"length": 425.0,
"function_hash": "59195814632473455996912241933457435978"
},
"source": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-a89dfd9b",
"signature_type": "Function",
"target": {
"function": "method_get_unit_by_control_group",
"file": "src/core/dbus-manager.c"
}
},
{
"digest": {
"length": 869.0,
"function_hash": "155167571133191932974658116898218518977"
},
"source": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-ad9d9e4a",
"signature_type": "Function",
"target": {
"function": "unit_attach_pid_to_cgroup_via_bus",
"file": "src/core/cgroup.c"
}
},
{
"digest": {
"length": 1242.0,
"function_hash": "148540261406276546440976422221838255267"
},
"source": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-b0ed6725",
"signature_type": "Function",
"target": {
"function": "lookup_unit_by_parameters",
"file": "src/core/varlink-unit.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"163892012129013710063961610264587615739",
"49031681591480842942608188524225756982",
"72192254100255337022035082201193890967"
]
},
"source": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-ba373fed",
"signature_type": "Line",
"target": {
"file": "src/core/dbus-manager.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"256406692636724318099188566617621187967",
"18807336714710237443412430177933117565",
"124146152361505942253624326253764154022",
"213014907543087954417222208856966696399",
"155749486648116376943465792835710697888",
"189270624675876049431673491653870231311",
"278174011506181650012093891772021196335",
"263648831089676623410422614747598886565",
"232139502598665204521338376348834152328",
"325017621312954648170452971624900218987",
"18352984722581899171126464917335812076",
"96242497319812032896692465926139910841",
"144283102426515370757047300920938651131",
"241078940390850658451854831647714383454",
"197499981571010875640250266549010717311",
"162628387609738084535990087139779764947",
"326644057514346498203267507856130701987",
"265211426542865397090117019515925833682",
"141611804735992738431252278501312589213",
"245481103852118720580561417500834136279",
"16676801778625204178331674330216305436",
"126478640253385430352511593054763026397"
]
},
"source": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-bab3c603",
"signature_type": "Line",
"target": {
"file": "src/basic/path-util.c"
}
},
{
"digest": {
"length": 425.0,
"function_hash": "59195814632473455996912241933457435978"
},
"source": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-bb3a351d",
"signature_type": "Function",
"target": {
"function": "method_get_unit_by_control_group",
"file": "src/core/dbus-manager.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"74241627649379572940237871204337248951",
"190248392954225862895046494764330743334",
"10476376812353058515822966104826628091",
"299444070388037751571925535897836317622",
"67599645563402544596169502877860093668",
"283638024774170399550235635902522654178",
"281971283650281598167650463558982248929",
"328120986930651100121905773514333408472",
"200752642364374135539716163744991112600",
"40418862966100084331393520030359755144",
"126156479297765251409707001179404804599",
"219787598027598433146582709437350440079",
"22105943878839436144900831120422026501",
"251097644099395644942048987030205569009",
"322833416182431868758742427212151661100",
"19150824768764388519534178422465828680",
"32785480672360690000447852086927422334",
"53656597144497354460746614333564476997",
"228288372448556391404277616053546092467",
"277184916848163418577271925738216190748",
"135877626244631961077416862034837461873",
"92734782597665648262202764004359833768",
"174627645836422835421248537357311418351",
"7247850072634367808628496207018425300",
"333323204208093190804577075855739419278",
"258184464472823272084302221619355594721",
"82388457489616484475894030477243470797",
"194624247029129851590293540029367006764",
"225487325156272971140887284395613942161",
"287883103823621647030638849570220025457",
"251186095520306058777024465048572394760",
"175989337095032823729906481893962220209",
"37367603014746772422967009677057759805",
"141096236403790000936924253659251643195",
"66683158135662271856265391228882079415",
"62419108531388061717866154063594651829",
"265317251034536772586443721982540638106"
]
},
"source": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-c14d9bdf",
"signature_type": "Line",
"target": {
"file": "src/core/cgroup.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"300532874240354212715197573424666005017",
"274244344614909416089701460549631153592",
"231743105680323372428445368076773344130",
"109381140122455274007722750063670073543"
]
},
"source": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-cba8f1b8",
"signature_type": "Line",
"target": {
"file": "src/basic/mkdir.c"
}
},
{
"digest": {
"length": 506.0,
"function_hash": "299032373140683460239902831410400055714"
},
"source": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-d4dcaf9c",
"signature_type": "Function",
"target": {
"function": "mkdir_parents_internal",
"file": "src/basic/mkdir.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"163892012129013710063961610264587615739",
"49031681591480842942608188524225756982",
"72192254100255337022035082201193890967"
]
},
"source": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-d51d4cb7",
"signature_type": "Line",
"target": {
"file": "src/core/dbus-manager.c"
}
},
{
"digest": {
"length": 541.0,
"function_hash": "218871691346125120582749923463132290384"
},
"source": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-d9f316f1",
"signature_type": "Function",
"target": {
"function": "path_startswith_full",
"file": "src/basic/path-util.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"163892012129013710063961610264587615739",
"49031681591480842942608188524225756982",
"222888949300005371739983155651681462076"
]
},
"source": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-e3223529",
"signature_type": "Line",
"target": {
"file": "src/core/dbus-manager.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"163892012129013710063961610264587615739",
"49031681591480842942608188524225756982",
"222888949300005371739983155651681462076"
]
},
"source": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-e4402c81",
"signature_type": "Line",
"target": {
"file": "src/core/dbus-manager.c"
}
},
{
"digest": {
"length": 123.0,
"function_hash": "332858278269434811836956059839228028264"
},
"source": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-eb38e513",
"signature_type": "Function",
"target": {
"function": "path_startswith",
"file": "src/basic/path-util.h"
}
},
{
"digest": {
"length": 1470.0,
"function_hash": "250778350787449981979473752131615627398"
},
"source": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-ed5912aa",
"signature_type": "Function",
"target": {
"function": "unit_attach_pids_to_cgroup",
"file": "src/core/cgroup.c"
}
},
{
"digest": {
"length": 869.0,
"function_hash": "155167571133191932974658116898218518977"
},
"source": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-f73af225",
"signature_type": "Function",
"target": {
"function": "unit_attach_pid_to_cgroup_via_bus",
"file": "src/core/cgroup.c"
}
},
{
"digest": {
"length": 425.0,
"function_hash": "59195814632473455996912241933457435978"
},
"source": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2026-29111-f9a7e252",
"signature_type": "Function",
"target": {
"function": "method_get_unit_by_control_group",
"file": "src/core/dbus-manager.c"
}
}
]