CVE-2026-15060
Received Received - Intake

Privilege Escalation in systemd-machined via polkit Policy

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 98a521c5-3a3e-4e2b-bc27-002067e0463c

Description
When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless unprivileged access is granted for the `register-machine` polkit action via a local, custom policy config file - versions older than v258 are not affected - unrelated to the systemd service manager (pid 1 or user session managers) - systemd-machined is not typically installed by default, and is typically in an optional, separate package (e.g.: systemd-container) - terminal-only or remote sessions (e.g.: ssh) are not affected

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-15060
EUVD
EUVD-2026-55627

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
systemd systemd-machined From 258 (inc) to 259 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects systems running systemd-machined versions 259 or higher, or version 258 with a custom policy allowing unprivileged 'register-machine' access. An unprivileged user in a graphical desktop session can kill any process, including privileged ones.

Detection Guidance

Check if systemd-machined is installed and running. Use 'systemctl status systemd-machined' to verify. If installed, check for unprivileged access to the 'register-machine' polkit action with 'pkcheck --action-id org.freedesktop.machine1.register-machine --process $$'.

Impact Analysis

If exploited, this flaw allows an attacker with local desktop access to terminate critical system processes, potentially causing system instability or denial of service. Terminal or remote sessions are not affected.

Mitigation Strategies

Upgrade systemd-machined to v259 or later. If using v258, ensure no custom polkit policy allows unprivileged 'register-machine' access. Remove or disable systemd-machined if not needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15060. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart