projects / systemd.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(merge: 891cdfe 21848b2)
systemd (247.3-7+deb11u8) bullseye-security; urgency=medium
authorArnaud Rebillout <arnaudr@debian.org>
Mon, 13 Apr 2026 07:18:40 +0000 (14:18 +0700)
committerArnaud Rebillout <arnaudr@debian.org>
Mon, 13 Apr 2026 07:18:40 +0000 (14:18 +0700)
commit5ca164c9f02050de0921e41c7d7c9e6ab9881c09
treefa8d603f3993b67bf594c9e9cb046858f44743eetree | snapshot
parent891cdfe7fb6bb9994cf60eb44827f31488f40578commit | diff
parent21848b2e4ca8ec4f91819d84d7397383971e4463commit | diff
systemd (247.3-7+deb11u8) bullseye-security; urgency=medium

  * Non-maintainer upload by the LTS Team.

  [ Arnaud Rebillout ]
  * Fix root-unittests.
  * CVE-2026-4105: Local privilege escalation in systemd-machined.
  * CVE-2026-29111: Local unprivileged user can trigger a stack overwriting.
  * CVE-2026-40225: Local root execution can occur via malicious hardware
    devices and unsanitized kernel output.
  * CVE-2026-40226: systemd-nspawn: escape-to-host action can occur via a
    crafted optional config file.

  [ Frantisek Sumsal ]
  * upstream-ci: fix test_no_failed() check.

  [ Michael Biebl ]
  * Skip flaky test_resolved_domain_restricted_dns in networkd-test.py.

[dgit import unpatched systemd 247.3-7+deb11u8]
223 files changed:
debian/README.Debian | | blob
debian/README.source | | blob
debian/changelog | | blob
debian/control | | blob
debian/copyright | | blob
debian/extra/checkout-upstream | | blob
debian/extra/dhclient-exit-hooks.d/timesyncd | | blob
debian/extra/fbdev-blacklist.conf | | blob
debian/extra/init-functions.d/40-systemd | | blob
debian/extra/initramfs-tools/hooks/udev | | blob
debian/extra/initramfs-tools/scripts/init-bottom/udev | | blob
debian/extra/initramfs-tools/scripts/init-top/udev | | blob
debian/extra/kernel-install.d/85-initrd.install | | blob
debian/extra/make-fbdev-blacklist | | blob
debian/extra/make-sysusers-basic | | blob
debian/extra/network/73-usb-net-by-mac.link | | blob
debian/extra/pam-configs/systemd | | blob
debian/extra/pam.d/systemd-user | | blob
debian/extra/rules-ubuntu/40-vm-hotadd.rules | | blob
debian/extra/rules-ubuntu/61-persistent-storage-android.rules | | blob
debian/extra/rules-ubuntu/71-power-switch-proliant.rules | | blob
debian/extra/rules-ubuntu/78-graphics-card.rules | | blob
debian/extra/rules/50-firmware.rules | | blob
debian/extra/rules/73-special-net-names.rules | | blob
debian/extra/rules/80-debian-compat.rules | | blob
debian/extra/start-udev | | blob
debian/extra/systemd-sysv-install | | blob
debian/extra/systemd.py | | blob
debian/extra/tmpfiles.d/debian.conf | | blob
debian/extra/udev.py | | blob
debian/extra/units-ubuntu/user@.service.d/timeout.conf | | blob
debian/extra/units/getty-static.service | | blob
debian/extra/units/rc-local.service.d/debian.conf | | blob
debian/extra/units/systemd-localed.service.d/locale-gen.conf | | blob
debian/gbp.conf | | blob
debian/git-cherry-pick | | blob
debian/libnss-myhostname.install | | blob
debian/libnss-myhostname.lintian-overrides | | blob
debian/libnss-myhostname.postinst | | blob
debian/libnss-myhostname.postrm | | blob
debian/libnss-mymachines.install | | blob
debian/libnss-mymachines.lintian-overrides | | blob
debian/libnss-mymachines.postinst | | blob
debian/libnss-mymachines.postrm | | blob
debian/libnss-resolve.install | | blob
debian/libnss-resolve.lintian-overrides | | blob
debian/libnss-resolve.postinst | | blob
debian/libnss-resolve.postrm | | blob
debian/libnss-systemd.install | | blob
debian/libnss-systemd.lintian-overrides | | blob
debian/libnss-systemd.postinst | | blob
debian/libnss-systemd.postrm | | blob
debian/libpam-systemd.install | | blob
debian/libpam-systemd.postinst | | blob
debian/libpam-systemd.prerm | | blob
debian/libsystemd-dev.install | | blob
debian/libsystemd0.install | | blob
debian/libsystemd0.symbols | | blob
debian/libudev-dev.install | | blob
debian/libudev1-udeb.install | | blob
debian/libudev1.install | | blob
debian/libudev1.symbols | | blob
debian/patches/0001-resolved-actually-check-authenticated-flag-of-SOA-tr.patch | | blob
debian/patches/0002-resolved-limit-the-number-of-signature-validations-i.patch | | blob
debian/patches/0003-resolved-reduce-the-maximum-nsec3-iterations-to-100.patch | | blob
debian/patches/Add-helper-for-case-independent-string-equality-checks.patch | | blob
debian/patches/Always-free-deserialized_subscribed-on-reload.patch | | blob
debian/patches/CVE-2025-4598-0.patch | | blob
debian/patches/CVE-2025-4598-1.patch | | blob
debian/patches/CVE-2025-4598-2.patch | | blob
debian/patches/CVE-2025-4598-3.patch | | blob
debian/patches/CVE-2025-4598-4.patch | | blob
debian/patches/CVE-2026-29111-1.patch | | blob
debian/patches/CVE-2026-29111-2.patch | | blob
debian/patches/CVE-2026-29111-3.patch | | blob
debian/patches/CVE-2026-29111-4.patch | | blob
debian/patches/CVE-2026-40225.patch | | blob
debian/patches/CVE-2026-40226-1.patch | | blob
debian/patches/CVE-2026-40226-2.patch | | blob
debian/patches/CVE-2026-4105.patch | | blob
debian/patches/Drop-bundled-copy-of-linux-if_arp.h.patch | | blob
debian/patches/LoadCredentials-do-not-assert-on-invalid-syntax.patch | | blob
debian/patches/Revert-udev-do-not-execute-hwdb-builtin-import-twice-or-t.patch | | blob
debian/patches/analyze-slightly-reword-PrivateTmp-message.patch | | blob
debian/patches/ata_id-Fixed-getting-Response-Code-from-SCSI-Sense-Data-2.patch | | blob
debian/patches/basic-add-make_mount_point_inode-helper.patch | | blob
debian/patches/basic-unit-name-adjust-comments.patch | | blob
debian/patches/basic-unit-name-do-not-use-strdupa-on-a-path.patch | | blob
debian/patches/btrfs-util-add-helper-that-abstracts-might-be-btrfs-subvo.patch | | blob
debian/patches/core-fix-mtime-calculation-of-dropin-files.patch | | blob
debian/patches/coredump-do-not-allow-user-to-access-coredumps-with-chang.patch | | blob
debian/patches/debian/Add-env-variable-for-machine-ID-path.patch | | blob
debian/patches/debian/Add-support-for-TuxOnIce-hibernation.patch | | blob
debian/patches/debian/Bring-tmpfiles.d-tmp.conf-in-line-with-Debian-defaul.patch | | blob
debian/patches/debian/Don-t-enable-audit-by-default.patch | | blob
debian/patches/debian/Downgrade-a-couple-of-warnings-to-debug.patch | | blob
debian/patches/debian/Drop-seccomp-system-call-filter-for-udev.patch | | blob
debian/patches/debian/Keep-journal-files-compatible-with-older-versions.patch | | blob
debian/patches/debian/Let-graphical-session-pre.target-be-manually-started.patch | | blob
debian/patches/debian/Make-run-lock-tmpfs-an-API-fs.patch | | blob
debian/patches/debian/Move-sysusers.d-sysctl.d-binfmt.d-modules-load.d-back-to-.patch | | blob
debian/patches/debian/Only-start-logind-if-dbus-is-installed.patch | | blob
debian/patches/debian/Re-enable-journal-forwarding-to-syslog.patch | | blob
debian/patches/debian/Revert-core-one-step-back-again-for-nspawn-we-actual.patch | | blob
debian/patches/debian/Revert-core-set-RLIMIT_CORE-to-unlimited-by-default.patch | | blob
debian/patches/debian/Revert-udev-fix-memleak.patch | | blob
debian/patches/debian/Revert-udev-link_update-should-fail-if-the-entry-in-symli.patch | | blob
debian/patches/debian/Revert-udev-make-algorithm-that-selects-highest-priority-.patch | | blob
debian/patches/debian/Skip-filesystem-check-if-already-done-by-the-initram.patch | | blob
debian/patches/debian/Skip-flaky-test_resolved_domain_restricted_dns-in-network.patch | | blob
debian/patches/debian/Use-Debian-specific-config-files.patch | | blob
debian/patches/debian/deny-list-upstream-test-02-ppc64el.patch | | blob
debian/patches/debian/deny-list-upstream-test-25.patch | | blob
debian/patches/debian/fsckd-daemon-for-inter-fsckd-communication.patch | | blob
debian/patches/debian/systemctl-do-not-shutdown-immediately-on-scheduled-shutdo.patch | | blob
debian/patches/debian/test-disable-DnsmasqClientTest.test_resolved_etc_hosts-in.patch | | blob
debian/patches/debian/udev-drop-SystemCallArchitectures-native-from-systemd-ude.patch | | blob
debian/patches/fix-stack-overflow-in-coredump-filter-0.patch | | blob
debian/patches/fix-stack-overflow-in-coredump-filter-1.patch | | blob
debian/patches/fix-stack-overflow-in-coredump-filter-2.patch | | blob
debian/patches/localed-Run-locale-gen-if-available-to-generate-missing-l.patch | | blob
debian/patches/logind-fix-getting-property-OnExternalPower-via-D-Bus.patch | | blob
debian/patches/machine-adjust-error-message-to-use-normalized-instead-of.patch | | blob
debian/patches/machine-basic-factor-out-helper-function-to-add-airlocked.patch | | blob
debian/patches/machine-enter-target-PID-namespace-when-adding-a-live-mou.patch | | blob
debian/patches/machined-varlink-fix-double-free.patch | | blob
debian/patches/meson-drop-arch-filtering-in-syscall-list.patch | | blob
debian/patches/network-Delay-addition-of-IPv6-Proxy-NDP-addresses.patch | | blob
debian/patches/pkg-config-make-prefix-overridable-again.patch | | blob
debian/patches/rm-rf-fstatat-might-fail-if-containing-dir-has-limited-ac.patch | | blob
debian/patches/rm-rf-optionally-fsync-after-removing-directory-tree.patch | | blob
debian/patches/rm-rf-refactor-rm_rf_children-split-out-body-of-directory.patch | | blob
debian/patches/rules-Move-ID_SMARTCARD_READER-definition-to-a-70-configu.patch | | blob
debian/patches/series | | blob
debian/patches/shared-calendarspec-abort-calculation-after-1000-iteratio.patch | | blob
debian/patches/shared-calendarspec-when-mktime-moves-us-backwards-jump-f.patch | | blob
debian/patches/shared-mount-util-use-namespace_fork-utils.patch | | blob
debian/patches/shared-rm-rf-loop-over-nested-directories-instead-of-inst.patch | | blob
debian/patches/shared-rm_rf-refactor-rm_rf-to-shorten-code-a-bit.patch | | blob
debian/patches/shared-rm_rf-refactor-rm_rf_children_inner-to-shorten-cod.patch | | blob
debian/patches/table-drop-trailing-white-spaces-of-the-last-cell-in-row.patch | | blob
debian/patches/test-ignore-LXC-filesystem-when-checking-for-writable-loc.patch | | blob
debian/patches/test-unset-TZ-before-timezone-sensitive-unit-tests-are-ru.patch | | blob
debian/patches/time-util-fix-buffer-over-run.patch | | blob
debian/patches/tmpfiles-st-may-have-been-used-uninitialized.patch | | blob
debian/patches/udev-always-create-device-symlinks-for-USB-disks.patch | | blob
debian/patches/udev-first-set-properties-based-on-usb-subsystem.patch | | blob
debian/patches/udevadm-trigger-do-not-return-immediately-on-EACCES.patch | | blob
debian/patches/unit-name-generate-a-clear-error-code-when-convertin.patch | | blob
debian/patches/virt-Fix-the-detection-for-Hyper-V-VMs.patch | | blob
debian/patches/virt-Support-detection-for-ARM64-Hyper-V-guests.patch | | blob
debian/patches/virt-detect-OpenStack-Nova-instance.patch | | blob
debian/rules | | blob
debian/salsa-ci.yml | | blob
debian/shlibs.local.in | | blob
debian/source/format | | blob
debian/systemd-container.install | | blob
debian/systemd-container.lintian-overrides | | blob
debian/systemd-container.maintscript | | blob
debian/systemd-container.postinst | | blob
debian/systemd-container.postrm | | blob
debian/systemd-coredump.install | | blob
debian/systemd-coredump.postinst | | blob
debian/systemd-coredump.prerm | | blob
debian/systemd-journal-remote.install | | blob
debian/systemd-journal-remote.postinst | | blob
debian/systemd-sysv.install | | blob
debian/systemd-sysv.postinst | | blob
debian/systemd-tests.install | | blob
debian/systemd-tests.lintian-overrides | | blob
debian/systemd-timesyncd.install | | blob
debian/systemd-timesyncd.postinst | | blob
debian/systemd-timesyncd.postrm | | blob
debian/systemd.NEWS | | blob
debian/systemd.bug-control | | blob
debian/systemd.bug-script | | blob
debian/systemd.dirs | | blob
debian/systemd.install | | blob
debian/systemd.links | | blob
debian/systemd.lintian-overrides | | blob
debian/systemd.maintscript | | blob
debian/systemd.postinst | | blob
debian/systemd.postrm | | blob
debian/systemd.preinst | | blob
debian/systemd.prerm | | blob
debian/systemd.triggers | | blob
debian/tests/assert.sh | | blob
debian/tests/boot-and-services | | blob
debian/tests/boot-smoke | | blob
debian/tests/build-login | | blob
debian/tests/control | | blob
debian/tests/fsck | | blob
debian/tests/hostnamed | | blob
debian/tests/lidswitch.evemu | | blob
debian/tests/localed-locale | | blob
debian/tests/localed-x11-keymap | | blob
debian/tests/logind | | blob
debian/tests/process-killer | | blob
debian/tests/root-unittests | | blob
debian/tests/storage | | blob
debian/tests/systemd-fsckd | | blob
debian/tests/timedated | | blob
debian/tests/udev | | blob
debian/tests/unit-config | | blob
debian/tests/upstream | | blob
debian/udev-udeb.dirs | | blob
debian/udev-udeb.install | | blob
debian/udev.NEWS | | blob
debian/udev.README.Debian | | blob
debian/udev.bug-control | | blob
debian/udev.bug-script | | blob
debian/udev.init | | blob
debian/udev.install | | blob
debian/udev.links | | blob
debian/udev.lintian-overrides | | blob
debian/udev.maintscript | | blob
debian/udev.postinst | | blob
debian/udev.postrm | | blob
debian/udev.preinst | | blob
debian/udev.prerm | | blob
debian/udev.triggers | | blob
debian/upstream/metadata | | blob
debian/watch | | blob
Unnamed repository; edit this file 'description' to name the repository.