CVE-2026-15060: systemd-machined Privilege Escalation Flaw

CVE-2026-15060 Overview

CVE-2026-15060 is an improper access control vulnerability [CWE-284] in systemd-machined. When systemd-machined v259 or later runs on a desktop system, an unprivileged user in an active graphical session can terminate arbitrary processes, including privileged ones. Version 258 is also affected when a custom polkit policy grants unprivileged access to the register-machine action. The flaw is scoped to local desktop sessions and does not affect terminal-only or remote sessions such as SSH. systemd-machined is not installed by default on most distributions and typically ships in an optional package such as systemd-container.

Critical Impact
An unprivileged desktop user can kill privileged processes, disrupting system services and enabling local denial-of-service conditions against security-relevant daemons.

Affected Products

systemd-machined v259 and later (default configuration)
systemd-machined v258 with a custom polkit policy permitting register-machine
Linux distributions shipping the systemd-container package on desktop installations

Discovery Timeline

2026-08-10 - CVE-2026-15060 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-15060

Vulnerability Analysis

The vulnerability resides in how systemd-machined authorizes actions through polkit. Starting in v259, the register-machine action is reachable by unprivileged users holding an active desktop graphical session. Once a machine is registered, the caller can direct systemd-machined to terminate processes associated with the registered scope. Because systemd-machined runs with elevated privileges and manages process scopes on behalf of callers, the termination signal reaches processes the caller could not otherwise signal directly. The impact is loss of availability for arbitrary processes, including those owned by root or by other users.

Root Cause

The root cause is an authorization gap in the polkit policy shipped with systemd-machined v259, which allows an active-session unprivileged user to invoke register-machine. In v258 the same outcome requires an administrator to install a custom policy granting that action. The privileged daemon then acts on the registration request without enforcing an additional check that the target processes belong to the caller.

Attack Vector

Exploitation requires local access with an active graphical session. Remote users, SSH sessions, and headless servers without a graphical session are not exposed. The attacker interacts with systemd-machined over D-Bus, registers a machine scope containing the target process identifier, and requests termination. See the GitHub Security Advisory GHSA-qwv4-3gwc-w5g8 for the upstream technical write-up.

Detection Methods for CVE-2026-15060

Indicators of Compromise

Unexpected termination of privileged daemons or user services on desktop hosts running systemd-machined
D-Bus calls to the org.freedesktop.machine1 interface from unprivileged session users invoking RegisterMachine or related methods
polkit authorization decisions granting org.freedesktop.machine1.register-machine to non-administrative users

Detection Strategies

Audit polkit logs (/var/log/auth.log, journalctl -u polkit) for approvals of the register-machine action originating from unprivileged UIDs
Correlate systemd-machined D-Bus activity with subsequent SIGKILL or SIGTERM delivery to processes outside the caller's UID scope
Baseline the installed version of systemd-container and flag hosts running v259 or later without the vendor patch

Monitoring Recommendations

Enable auditd rules to record kill() syscalls issued by PID 1 or systemd-machined against processes owned by other UIDs
Alert on installation or modification of files under /etc/polkit-1/rules.d/ that reference register-machine
Monitor service restart loops on desktop endpoints, which may indicate repeated termination of privileged services

How to Mitigate CVE-2026-15060

Immediate Actions Required

Inventory desktop endpoints for the presence of the systemd-container package and the running version of systemd-machined
Apply the upstream systemd security update once available from your distribution vendor
Review custom polkit policies in /etc/polkit-1/ for rules granting org.freedesktop.machine1.register-machine to non-administrators

Patch Information

Refer to the upstream systemd GitHub Security Advisory GHSA-qwv4-3gwc-w5g8 for fixed versions and distribution-specific backports. Users on v258 without a custom permissive policy are not affected. Users on versions older than v258 are not affected.

Workarounds

Remove or mask systemd-machined on desktop systems that do not require container or virtual machine registration: systemctl mask systemd-machined.service
Uninstall the systemd-container package where the functionality is not needed
Restrict the org.freedesktop.machine1.register-machine action to administrators by adding an explicit deny rule under /etc/polkit-1/rules.d/

bash

# Restrict register-machine to administrators via polkit
cat >/etc/polkit-1/rules.d/10-machined-restrict.rules <<'EOF'
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.machine1.register-machine" &&
        !subject.isInGroup("wheel")) {
        return polkit.Result.NO;
    }
});
EOF
systemctl restart polkit