From 0be927b89a319c9ac35249354558e9f4cb102fd0 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Mon, 20 Apr 2026 11:58:23 +0200 Subject: [PATCH] package/systemd: security bump to v258.7 This fixes the following vulnerabilities: - CVE-2026-29111 (fixed in 258.5): systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available. https://www.cve.org/CVERecord?id=CVE-2026-29111 - CVE-2026-40226 (fixed in 258.6): In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file. https://www.cve.org/CVERecord?id=CVE-2026-40226 https://github.com/systemd/systemd/security/advisories/GHSA-9mj4-rrc3-gjcx Signed-off-by: Titouan Christophe [Marcus: note which minor versions included the respective security fixes] Signed-off-by: Marcus Hoffmann (cherry picked from commit f6e0ad3858687d5a0194a3abb4171770fd49be35) Signed-off-by: Thomas Perale --- package/systemd/systemd.hash | 2 +- package/systemd/systemd.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/systemd/systemd.hash b/package/systemd/systemd.hash index d5a97ffcbd..e96d3ba7ad 100644 --- a/package/systemd/systemd.hash +++ b/package/systemd/systemd.hash @@ -1,5 +1,5 @@ # sha256 locally computed -sha256 5c95e54e555b21594ab11e76f91a092c6383553ed725292eb0a929bf2fe028ae systemd-258.4.tar.gz +sha256 6bd311c25f00d634ae3b4544d582e27df0d4166e6ba3d403b18b3129d7f44cae systemd-258.7.tar.gz sha256 ac4985facb553559981f507982444d779115e3e3a4c8b7847ae956198490c1b3 LICENSE.GPL2 sha256 6d9bb3b7fc818a8facc4cc296060a0883fef8710d6498f86165335846e82ee9d LICENSE.LGPL2.1 sha256 c9e7bf5b7c243c719b8b43c36158effb9b54c5e80abc9d82e4b2d4b2a4aa64ad LICENSES/alg-sha1-public-domain.txt diff --git a/package/systemd/systemd.mk b/package/systemd/systemd.mk index 4b488857fd..9ce4f8fef2 100644 --- a/package/systemd/systemd.mk +++ b/package/systemd/systemd.mk @@ -19,7 +19,7 @@ # - Diff sysusers.d with the previous version # - Diff factory/etc/nsswitch.conf with the previous version # (details are often sprinkled around in README and manpages) -SYSTEMD_VERSION = 258.4 +SYSTEMD_VERSION = 258.7 SYSTEMD_SITE = $(call github,systemd,systemd,v$(SYSTEMD_VERSION)) SYSTEMD_LICENSE = \ LGPL-2.1+, \