systemd-machined: unvalidated RegisterMachine class lets a local user reach root command execution

Impact

systemd-machined does not sufficiently validate the class parameter of the RegisterMachine D-Bus method. A local unprivileged user can register a machine with a crafted class value and be left holding a usable, attacker-controlled machine object, then invoke methods on that privileged object to run commands as root on the host. On a GPU node this is a direct local-to-root path for anyone who lands a shell on the host - an operator with a login shell, a compromised job that escapes to the host, or any service account with D-Bus access. It does not by itself cross a container boundary, but it removes the last step for anyone who already has one. The CVSS vector notes high attack complexity and a user-interaction requirement, so it is not a trivially repeatable one-shot.

Who can reach it

Local unprivileged user with access to the system D-Bus on the host. Authentication as any ordinary user is enough; no root, no network reachability.

What to do

Apply the vendor systemd update - Red Hat ships it as RHSA-2026:7299, and upstream has GHSA-4h6x-r8vx-3862. Updating systemd restarts systemd-machined, but a full systemd upgrade on a running node is normally paired with a reboot at the next drain window; on nodes that do not run containers or VMs via machined, masking systemd-machined removes the exposure without a reboot.

References

Related entries

• QEMU virtio-blk: malformed guest SCSI request causes host-heap out-of-bounds writeCVE-2026-48914 · QEMU virtio-blk device (SCSI request descriptor size validation)Medium
• Linux kernel (AF_UNIX): Use-after-free in unix_stream_sendpage - local privilege escalation, no capabilities neededCVE-2023-4622 · Linux kernel (AF_UNIX)Medium
• Linux kernel (net/sched ETS): Out-of-bounds indexing in the ETS qdisc - memory corruption from CAP_NET_ADMINCVE-2025-21692 · Linux kernel (net/sched ETS)Medium
• Linux kernel (drivers/bus/fsl-mc): The fsl-mc bus read its driver_override string without holding the device lock, soCVE-2026-53115 · Linux kernel (drivers/bus/fsl-mc)Medium
• Linux kernel (drivers/pci): The PCI bus match callback read driver_override without the device lock, so the overrideCVE-2026-53120 · Linux kernel (drivers/pci)Medium
• Linux KVM (arch/x86/kvm/svm.c, vmx.c) and Xen 4.3.x-4.6.x - #AC exception handling: A guest raises alignment-checkCVE-2015-5307 · Linux KVM (arch/x86/kvm/svm.c, vmx.c) and Xen 4.3.x-4.6.x - #AC exception handlingMedium