CVE-2026-15059 Overview
CVE-2026-15059 is a path traversal vulnerability in the systemd-oomd inter-process communication (IPC) API. The flaw allows local unprivileged users to terminate arbitrary local processes by supplying crafted cgroup paths that bypass validation. The weakness is categorized as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. Exploitation requires local access with low privileges and no user interaction. Successful abuse results in the termination of processes the attacker would not normally be authorized to signal, producing a denial-of-service impact on Linux systems that ship systemd-oomd.
Critical Impact
Local unprivileged users can terminate arbitrary processes, including those owned by other users or root, causing service disruption and denial of service.
Affected Products
- systemd (upstream, component systemd-oomd)
- Linux distributions bundling affected systemd-oomd releases
- Systems where the systemd-oomd IPC interface is exposed to local users
Discovery Timeline
- 2026-08-10 - CVE-2026-15059 published to the National Vulnerability Database (NVD)
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-15059
Vulnerability Analysis
The systemd-oomd daemon monitors memory pressure and terminates processes within specific control groups (cgroups) when resources become exhausted. It exposes an IPC API that accepts cgroup path arguments from clients. The daemon fails to validate these paths against directory traversal sequences before acting on them. An unprivileged caller can submit a path containing .. components or other traversal artifacts to reference cgroups outside the intended scope. The daemon then issues termination signals against processes within the resolved cgroup, effectively granting the caller the ability to kill any local process reachable through the cgroup hierarchy.
Root Cause
The root cause is missing path canonicalization and traversal validation in the systemd-oomd IPC handler. The handler trusts caller-supplied cgroup path strings and resolves them without rejecting relative segments or sequences that escape the permitted subtree. Because systemd-oomd runs with privileges sufficient to signal processes across the system, the missing check translates directly into an unauthorized kill primitive for any local user able to reach the IPC endpoint.
Attack Vector
Exploitation is local. An unprivileged user connects to the systemd-oomd IPC interface and issues a request referencing a cgroup path constructed with traversal sequences. The daemon resolves the path outside the intended boundary and terminates processes belonging to that cgroup. The attacker can iteratively target system services, other users' sessions, or security-relevant daemons. Refer to the GitHub Security Advisory GHSA-652q-wxr6-h5j6 for upstream technical details.
No verified proof-of-concept code has been published.
See the upstream advisory for reproduction details.
Detection Methods for CVE-2026-15059
Indicators of Compromise
- Unexpected SIGKILL or SIGTERM delivery to processes recorded in systemd-oomd logs referencing cgroup paths containing .. or unusual traversal patterns.
- systemd-oomd journal entries reporting termination of processes outside cgroups configured with ManagedOOMSwap or ManagedOOMMemoryPressure.
- Unexplained restarts or crashes of long-running services on hosts where memory pressure metrics do not justify OOM action.
Detection Strategies
- Audit systemd-oomd journal output (journalctl -u systemd-oomd) for kill events whose target cgroup paths do not match configured managed units.
- Correlate process termination events with the invoking UID reported over the IPC channel to identify unprivileged callers issuing kill requests.
- Baseline expected OOM kill frequency per host and alert on statistical deviations that coincide with local user activity.
Monitoring Recommendations
- Forward systemd-oomd logs and audit records into a centralized SIEM for cross-host correlation and retention.
- Monitor sd-bus and D-Bus traffic to the systemd-oomd service for path arguments containing traversal sequences.
- Track process lifecycle events on Linux endpoints and flag terminations of privileged services triggered by non-root callers.
How to Mitigate CVE-2026-15059
Immediate Actions Required
- Apply the fixed systemd package from your Linux distribution as soon as vendor updates become available.
- Inventory hosts running systemd-oomd and prioritize multi-user systems, shared build servers, and container hosts for patching.
- Restrict local shell access on affected systems until updates are deployed.
Patch Information
Upstream patch details are published in the systemd GitHub Security Advisory GHSA-652q-wxr6-h5j6. Distribution maintainers will ship backported fixes in their respective systemd packages. Verify the installed systemd version against your distribution's security bulletin after updating.
Workarounds
- Disable the systemd-oomd.service unit on hosts where memory pressure management is not required, using systemctl disable --now systemd-oomd.service.
- Remove or restrict ManagedOOM* directives in unit files to reduce the scope of cgroups the daemon acts upon.
- Limit local logon to trusted accounts on systems where systemd-oomd must remain enabled prior to patching.
# Check systemd-oomd status and disable if not required
systemctl status systemd-oomd.service
sudo systemctl disable --now systemd-oomd.service
# Verify installed systemd version after patching
systemctl --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
