CVE-2026-15060
MEDIUM
MEDIUM
Priority: 0.00
BB Relevance:
24/100
Published: 2026-08-10
Modified: 2026-10-23
First seen: 2026-10-29
Status: active
Attack Surface
No Interaction
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
Low
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected