CVE-2026-16742: systemd-homed Privilege Escalation Flaw

CVE-2026-16742 Overview

CVE-2026-16742 is a local privilege escalation vulnerability in systemd-homed, the systemd component that manages portable user home directories. The flaw allows a local, logged-in user managed by homed to add themselves to arbitrary system groups. A successful exploit grants the user privileges associated with those groups, including groups such as wheel, sudo, or disk that translate to full administrative control. The issue is tracked under CWE-269: Improper Privilege Management and is described in the systemd GitHub Security Advisory GHSA-jm29-p7hh-vjhv.

Critical Impact
A local homed-managed user can escalate to system-level privileges by joining sensitive system groups, breaking the isolation model that systemd-homed is meant to enforce.

Affected Products

systemd (component: systemd-homed)
Linux distributions shipping systemd-homed with user-managed home records
Systems where users are provisioned and authenticated through homectl and homed

Discovery Timeline

2026-08-10 - CVE-2026-16742 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-16742

Vulnerability Analysis

systemd-homed manages user accounts through signed JSON user records that describe identity, credentials, and group memberships. The service is supposed to distinguish between groups a user may self-declare and privileged system groups that must only be assigned by an administrator. This vulnerability breaks that boundary. A local, authenticated homed-managed user can cause arbitrary system group memberships to be applied to their own session. The impact is a direct escalation from an unprivileged shell to a member of security-critical groups such as wheel, sudo, docker, or disk, each of which offers a well-known path to root. Exploitation requires local access, valid credentials for a homed user, and user interaction, and the attack complexity is high because timing or session-state conditions must align. Once the group is added, confidentiality, integrity, and availability of the host are all compromised.

Root Cause

The root cause is improper privilege management [CWE-269] in the code path that reconciles a user's home record with the active session's supplementary group list. Group entries that should require administrator authorization are accepted from a context reachable by the logged-in user, so group membership state is applied without sufficient validation of who requested it.

Attack Vector

The attacker must already hold valid credentials for a local homed-managed account and must be logged in. The attacker triggers the vulnerable code path through normal homed interactions, causing an arbitrary system group to be attached to the user. After re-establishing a session or invoking a tool that reads the updated group set, the attacker inherits the privileges of that group and pivots to root through group-specific abuse. Refer to the systemd security advisory for the precise trigger sequence.

Detection Methods for CVE-2026-16742

Indicators of Compromise

Unexpected additions of homed-managed users to sensitive groups such as wheel, sudo, docker, disk, adm, or systemd-journal.
Modifications to signed user records under /var/lib/systemd/home/ that alter the memberOf field outside of an administrator workflow.
homectl update or D-Bus calls to org.freedesktop.home1 originating from a user session rather than an administrator context.

Detection Strategies

Audit systemd-homed journal entries (journalctl -u systemd-homed.service) for group-membership changes not paired with an administrator authentication event.
Baseline the group membership of every homed-managed user and alert on deltas, especially additions to privileged groups.
Correlate getent group snapshots over time to identify users gaining membership in security-relevant groups without a change-management ticket.

Monitoring Recommendations

Forward systemd and PAM audit logs to a central analytics tier and alert on privileged-group membership changes.
Enable Linux audit rules on /etc/group, /etc/gshadow, and /var/lib/systemd/home/ to record write access.
Track process ancestry for privilege-sensitive binaries (sudo, su, pkexec) executed by homed users shortly after login.

How to Mitigate CVE-2026-16742

Immediate Actions Required

Update systemd to the fixed release supplied by your Linux distribution as soon as it is available; consult the systemd security advisory for exact versions.
Enumerate all homed-managed accounts with homectl list and review their current group memberships for unauthorized entries.
Restrict local login on multi-user hosts to trusted accounts until patches are deployed.

Patch Information

A fix is coordinated through the systemd project and published in the GitHub Security Advisory GHSA-jm29-p7hh-vjhv. Apply the patched systemd package from your distribution vendor and restart systemd-homed.service. Verify the running version with systemctl --version after the update.

Workarounds

Where operationally acceptable, disable systemd-homed.service and migrate affected accounts to standard /etc/passwd accounts until patched builds are installed.
Remove homed-managed users from all privileged groups and enforce group assignment only through configuration management.
Limit physical and remote console access so that only administrators can obtain a local session on hosts running systemd-homed.

bash

# Verify systemd-homed status and review managed users
systemctl status systemd-homed.service
homectl list

# Temporarily disable systemd-homed until patches are applied
sudo systemctl disable --now systemd-homed.service

# Audit group membership for a specific homed user
id <username>
getent group wheel sudo docker disk adm