SUSE-SU-2026:20822-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-202620822-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:20822-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:20822-1
Upstream
CVE (2)
Related
CVE (2)
Published
2026-03-24T09:27:18Z
Modified
2026-03-26T17:24:07Z
Summary
Security update for systemd
Details

This update for systemd fixes the following issues:

Security issues:

  • CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
  • CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
  • udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

Non security issues:

  • Name libsystemd-{shared,core} based on the major version of systemd and the package release number (bsc#1228081, bsc#1256427)
  • detect-virt: bare-metal GCE only for x86 and i386 (bsc#1254293)

Changelog:

  • a943e3ce2f machined: reject invalid class types when registering machines
  • 71593f77db udev: fix review mixup
  • 73a89810b4 udev-builtin-net-id: print cescaped bad attributes
  • 0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
  • 40905232e2 udev: ensure tag parsing stays within bounds
  • 7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
  • d018ac1ea3 udev: check for invalid chars in various fields received from the kernel
  • aef6e11921 core/cgroup: avoid one unnecessary strjoina()
  • cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
  • 26a748f727 core: validate input cgroup path more prudently
  • 99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs
  • 8bbac1d508 detect-virt: bare-metal GCE only for x86 and i386
References

Affected packages

SUSE:Linux Micro 6.0 / systemd

Package

Name
systemd
Purl
pkg:rpm/suse/systemd&distro=SUSE%20Linux%20Micro%206.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
254.27-3.1

Ecosystem specific 

{
    "binaries":  [
        {
            "libsystemd0":  "254.27-3.1",
            "libudev1":  "254.27-3.1",
            "systemd":  "254.27-3.1",
            "systemd-container":  "254.27-3.1",
            "systemd-coredump":  "254.27-3.1",
            "systemd-experimental":  "254.27-3.1",
            "systemd-journal-remote":  "254.27-3.1",
            "systemd-portable":  "254.27-3.1",
            "udev":  "254.27-3.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:20822-1.json"