CVE catalog

CVE-2026-16552

A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an e

[CVE catalog]

Severity: Medium · CVSS 6.3
Published: Jul 22, 2026, 12:00:00 AM UTC
Source: [NVD] · [CVE record]

[REJECTED] A flaw was found in systemd-tmpfiles. When processing a tmpfiles.d configuration entry that writes to a file, systemd-tmpfiles can follow a symbolic link placed by an unprivileged local user, and an existing safety check does not detect this specific case because it always treats transitions away from the root user as safe. On systems where a tmpfiles.d configuration targets a path an unprivileged user can influence, this could allow that user to redirect a privileged systemd-tmpfiles write to a file of their choosing, though the content written remains determined by the existing configuration rather than by the unprivileged user. The highest threat from this vulnerability is to integrity. systemd: systemd-tmpfiles symlink-redirected arbitrary file overwrite via a CHASE_SAFE root-to-unprivileged ownership transition bypass This CVE has been marked as rejected by the assigning CNA. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	systemd	bookworm	Not reported	vulnerable

Fixed-version evidence

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libnss-myhostname]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[libnss-mymachines]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[libnss-resolve]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[libnss-systemd]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[libpam-systemd]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[libsystemd0]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[libsystemd-dev]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[libsystemd-shared]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[libudev1]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[libudev-dev]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[systemd]Affected
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[systemd-boot]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[systemd-boot-efi]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[systemd-container]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[systemd-coredump]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[systemd-dev]Affected
Source package: [systemd]
Details (2)
- 254.26-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
[systemd-homed]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[systemd-journal-remote]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[systemd-oomd]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
[systemd-resolved]Affected
Source package: [systemd]
Details (6)
- 252.39-1~deb12u2 · amd64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 252.39-1~deb12u2 · arm64 · bookworm
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 254.26-1~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · amd64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm
- 252.38-1~deb12u1 · arm64 · bookworm-security
  Affected
  nvd · systemd · debian · bookworm

Next results

Observed: Oct 23, 2026, 9:43:35 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]