Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-2245

NIXPKGS-2026-2245
published 13 hours ago
Systemd: systemd-tmpfiles symlink-redirected arbitrary file overwrite via a chase_safe root-to-unprivileged ownership transition bypass
Permalink CVE-2026-16552
6.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
updated 13 hours ago by @LeSuisse Activity log
  • Created suggestion 1 day, 5 hours ago
  • @symphorien ignored package nagiosPlugins.check_systemd 23 hours ago
  • @LeSuisse ignored reference https://g… 13 hours ago
  • @LeSuisse ignored
    39 packages
    • udev
    • systemd-lsp
    • systemdLibs
    • rofi-systemd
    • systemd-wait
    • systemdUkify
    • systemdgenie
    • systemdMinimal
    • systemd-netlogd
    • systemd-bootchart
    • systemd-credsubst
    • systemd-manager-tui
    • systemd-journal2gelf
    • systemd-lock-handler
    • ocamlPackages.systemd
    • phpExtensions.systemd
    • haskellPackages.systemd
    • php82Extensions.systemd
    • php83Extensions.systemd
    • php84Extensions.systemd
    • php85Extensions.systemd
    • systemd-language-server
    • update-systemd-resolved
    • haskellPackages.systemd-api
    • prometheus-systemd-exporter
    • haskellPackages.warp-systemd
    • ocamlPackages_latest.systemd
    • gnomeExtensions.systemd-status
    • gnomeExtensions.systemd-manager
    • python313Packages.systemd-python
    • python314Packages.systemd-python
    • haskellPackages.libsystemd-journal
    • gnomeExtensions.systemd-manager-neo
    • python313Packages.systemdunitparser
    • python314Packages.systemdunitparser
    • python313Packages.jupyterhub-systemdspawner
    • python314Packages.jupyterhub-systemdspawner
    • vscode-extensions.coolbear.systemd-unit-file
    • gnomeExtensions.systemd-offline-update-indicator
    13 hours ago
  • @LeSuisse accepted 13 hours ago
  • @LeSuisse published on GitHub 13 hours ago
Systemd: systemd-tmpfiles symlink-redirected arbitrary file overwrite via a chase_safe root-to-unprivileged ownership transition bypass

A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats transitions away from the root user as safe. On systems where a tmpfiles.d configuration targets a path an unprivileged user can influence, this could allow that user to redirect a privileged systemd-tmpfiles write to a file of their choosing, though the content written remains determined by the existing configuration rather than by the unprivileged user. The highest threat from this vulnerability is to integrity.

Affected products

systemd

Matching in nixpkgs

pkgs.systemd

System and service manager for Linux

Ignored packages (40)

pkgs.udev

System and service manager for Linux

pkgs.systemd-netlogd

Forwards messages from the journal to other hosts over the network

pkgs.systemd-bootchart

Boot performance graphing tool from systemd

  • nixos-unstable 235
    • nixpkgs-unstable 235
    • nixos-unstable-small 235
  • nixos-26.05 235
    • nixos-26.05-small 235
    • nixpkgs-26.05-darwin 235

pkgs.ocamlPackages.systemd

OCaml module for native access to the systemd facilities

  • nixos-unstable 1.3
    • nixpkgs-unstable 1.3
    • nixos-unstable-small 1.3
  • nixos-26.05 1.3
    • nixos-26.05-small 1.3
    • nixpkgs-26.05-darwin 1.3

pkgs.update-systemd-resolved

Helper script for OpenVPN to directly update the DNS settings of a link through systemd-resolved via DBus

pkgs.gnomeExtensions.systemd-manager-neo

Monitor and manage system and user systemd services directly from the GNOME top panel. Features RAM/Uptime tracking and easy log access.

  • nixos-unstable 6
    • nixpkgs-unstable 6
    • nixos-unstable-small 6
  • nixos-26.05 6
    • nixos-26.05-small 6
    • nixpkgs-26.05-darwin 6

pkgs.python313Packages.systemdunitparser

SystemdUnitParser is an extension to Python's configparser.RawConfigParser to properly parse systemd unit files

  • nixos-unstable 0.4
    • nixpkgs-unstable 0.4
    • nixos-unstable-small 0.4
  • nixos-26.05 0.4
    • nixos-26.05-small 0.4
    • nixpkgs-26.05-darwin 0.4

pkgs.python314Packages.systemdunitparser

SystemdUnitParser is an extension to Python's configparser.RawConfigParser to properly parse systemd unit files

  • nixos-unstable 0.4
    • nixpkgs-unstable 0.4
    • nixos-unstable-small 0.4
  • nixos-26.05 0.4
    • nixos-26.05-small 0.4
    • nixpkgs-26.05-darwin 0.4

Package maintainers