CVE-2026-16742
Description
A flaw was found in systemd-homed. A local, logged-in user can exploit a missing signature verification in the authentication path when processing home records. This vulnerability allows the user to add arbitrary system groups to their account, which can lead to local privilege escalation and enable them to gain elevated access on the system.
Statement
systemd-homed contains the vulnerable code path — missing cryptographic signature verification of home records in home_authenticating_finish() (src/home/homed-home.c) — starting from upstream systemd v245. Red Hat Enterprise Linux 7 (systemd 219) and Red Hat Enterprise Linux 8 (systemd 239), and products built on the el8 systemd (OpenShift 4.12 / RHCOS on el8), predate v245 and do not ship the vulnerable code — they are not affected. Red Hat Enterprise Linux 9 (systemd 252), Red Hat Enterprise Linux 10 (systemd 257), Red Hat In-Vehicle OS, and OpenShift 4.13+ / RHCOS on el9 ship the affected code and are affected. Exploitation is only possible where systemd-homed is actively used to manage user accounts (homectl-created users with the NSS systemd module enabled), which is not the default user-management configuration on Red Hat Enterprise Linux; this limits real-world exposure but does not remove the vulnerable code. Red Hat rates this Important because it permits a local, logged-in homed-managed user to escalate privileges to root.
Mitigation
Do not use systemd-homed to manage user accounts. Systems using the traditional /etc/passwd mechanism (the default on Red Hat Enterprise Linux) are not exploitable. Where systemd-homed is not required, ensure it is disabled (systemctl disable --now systemd-homed) and that the systemd NSS module is not present in /etc/nsswitch.conf.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 6.7 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | Required |
| Scope | Changed | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
