Critical systemd Vulnerabilities Affect Multiple Ubuntu Releases

Two significant vulnerabilities in systemd have been reported, affecting Ubuntu 22.04 LTS, 24.04 LTS, and 25.10. The first, CVE-2026-40226, allows local attackers to escape to the host system and execute arbitrary code via improper handling of configuration files in systemd-nspawn. The second, CVE-2023-7008, involves incorrect validation of DNSSEC records by systemd-resolved, enabling DNS record manipulation. Both vulnerabilities necessitate immediate system updates and reboots to mitigate risks. Ubuntu Pro users benefit from extended security coverage for these issues. The vulnerabilities were disclosed in a security notice on June 8, 2026.

Key Points: • CVE-2026-40226 allows local code execution via systemd-nspawn vulnerabilities. • CVE-2023-7008 affects DNSSEC validation in systemd-resolved, impacting Ubuntu 22.04 LTS. • Immediate updates and reboots are required to mitigate these vulnerabilities.