CVE-2026-40225: Medium severity systemd udev (systemd) vulnerability
In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 255-30 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 255-28
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40225?
CVE-2026-40225 is considered a high-severity vulnerability due to the potential for local root execution.
How do I fix CVE-2026-40225?
To mitigate CVE-2026-40225, update udev in systemd to version 260 or later.
Who is affected by CVE-2026-40225?
CVE-2026-40225 affects all versions of udev in systemd prior to 260.
What type of vulnerability is CVE-2026-40225?
CVE-2026-40225 is a local privilege escalation vulnerability that can be exploited through malicious hardware devices.
What can be exploited in CVE-2026-40225?
CVE-2026-40225 can be exploited through unsanitized kernel output, allowing unauthorized local root access.