systemdoomd 250260 Path Traversal Allows Process Termination
CVE-2026-15059 Published on August 10, 2026
systemd-oomd: unprivileged users can terminate arbitrary processes
Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.
Vulnerability Analysis
CVE-2026-15059 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Types
What is a Directory traversal Vulnerability?
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2026-15059 has been classified to as a Directory traversal vulnerability or weakness.
What is an insecure temporary file Vulnerability?
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2026-15059 has been classified to as an insecure temporary file vulnerability or weakness.
Affected Versions
systemd-oomd:- Version 250 and below 261, 260.3, 259.7, 258.9 is affected.