CVE-2026-15060 in systemd
Summary
by MITRE • 08/10/2026
When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones.
- versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability described represents a critical privilege escalation flaw in systemd-machined service management component affecting versions 259 and later, or version 258 with specific custom polkit policies. This issue occurs exclusively within desktop graphical environments where unprivileged users can leverage the register-machine polkit action to gain dangerous system control capabilities. The vulnerability stems from insufficient access controls within the systemd-machined daemon which allows unauthorized process termination including privileged system processes that should normally be protected from user interference.
This security flaw operates through a specific pathway involving the polkit authorization framework where custom policy configurations can inadvertently grant unprivileged users the ability to execute register-machine operations. When such conditions are met, an attacker can utilize the systemd-machined service to send kill signals to any process running on the system regardless of its privilege level or security context. The technical implementation involves the daemon's failure to properly validate process ownership and privilege boundaries during machine registration operations, creating a direct pathway for arbitrary process termination through the established communication interface.
The operational impact of this vulnerability extends beyond simple process killing to potentially compromise entire system stability and security posture. An unprivileged user could target critical system processes including network services, authentication daemons, or security monitoring tools, effectively disrupting system functionality and potentially creating opportunities for further exploitation. The vulnerability's scope is particularly concerning because it operates at the system service level rather than being confined to user-space applications, making it a significant threat vector for desktop environments where users may not be fully trusted.
Systems affected by this vulnerability typically include those running systemd versions 259 or higher, or version 258 with custom polkit policies that permit register-machine access. The vulnerability is specifically tied to desktop graphical sessions and does not affect terminal-only or remote SSH connections, which suggests the issue may be related to how graphical session contexts interact with the polkit authorization framework. This limitation in scope makes the vulnerability more targeted but potentially more dangerous within affected environments where users have physical access and can leverage GUI-based tools to exploit the flaw.
This vulnerability maps directly to CWE-284 - Improper Access Control, specifically targeting unauthorized process manipulation through service interfaces. The attack pattern aligns with ATT&CK technique T1059.003 - Command and Scripting Interpreter: Windows Command Shell, though adapted for Linux environments where the systemd-machined service provides the execution pathway. The threat model suggests this vulnerability could be exploited by malicious actors within physical access scenarios or social engineering campaigns targeting desktop users.
Mitigation strategies should focus on restricting polkit policies that grant register-machine access to unprivileged users, particularly in desktop environments where such access is not required for legitimate system administration tasks. System administrators should audit existing polkit configurations and remove or restrict permissions for the register-machine action unless absolutely necessary for specific user groups. Additionally, organizations should consider disabling systemd-machined service on desktop systems where it's not required, or implementing proper privilege separation policies that prevent unprivileged users from accessing potentially dangerous system services. The recommended approach involves implementing least-privilege principles through careful polkit policy management and ensuring that desktop environments maintain proper security boundaries between user sessions and system-critical services.
The vulnerability highlights the importance of proper authorization framework implementation in system services and demonstrates how seemingly innocuous service features can create significant security risks when not properly constrained. Organizations should implement comprehensive monitoring for unauthorized process termination activities and establish proper incident response procedures to detect potential exploitation attempts. Regular security audits of polkit policies and systemd configuration should be conducted to identify and remediate similar access control vulnerabilities that could potentially allow privilege escalation or system disruption attacks.