🛡️ SUSE-SU-2026:20822-1 — systemd (CVE-2026-4105 +1 more)

Security update for systemd

This update for systemd fixes the following issues:

Security issues:

• CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
• CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
• udev: check for invalid chars in various fields received from the kernel (bsc#1259697).

Non security issues:

• Name libsystemd-{shared,core} based on the major version of systemd and the

package release number (bsc#1228081, bsc#1256427)

• detect-virt: bare-metal GCE only for x86 and i386 (bsc#1254293)

Changelog:

• a943e3ce2f machined: reject invalid class types when registering machines
• 71593f77db udev: fix review mixup
• 73a89810b4 udev-builtin-net-id: print cescaped bad attributes
• 0f360bfdc0 udev-builtin-net_id: do not assume the current interface name is ethX
• 40905232e2 udev: ensure tag parsing stays within bounds
• 7bce9026e3 udev: ensure there is space for trailing NUL before calling sprintf
• d018ac1ea3 udev: check for invalid chars in various fields received from the kernel
• aef6e11921 core/cgroup: avoid one unnecessary strjoina()
• cc7426f38a sd-json: fix off-by-one issue when updating parent for array elements
• 26a748f727 core: validate input cgroup path more prudently
• 99d8308fde core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs
• 8bbac1d508 detect-virt: bare-metal GCE only for x86 and i386