CVE-2026-16742

A flaw was found in systemd-homed. A local, logged-in user can exploit a missing signature verification in the authentication path when processing home records. This vulnerability allows the user to add arbitrary system groups to their account, which can lead to local privilege escalation and enable them to gain elevated access on the system.

systemd-homed contains the vulnerable code path — missing cryptographic signature verification of home records in home_authenticating_finish() (src/home/homed-home.c) — starting from upstream systemd v245. Red Hat Enterprise Linux 7 (systemd 219) and Red Hat Enterprise Linux 8 (systemd 239), and products built on the el8 systemd (OpenShift 4.12 / RHCOS on el8), predate v245 and do not ship the vulnerable code — they are not affected. Red Hat Enterprise Linux 9 (systemd 252), Red Hat Enterprise Linux 10 (systemd 257), Red Hat In-Vehicle OS, and OpenShift 4.13+ / RHCOS on el9 ship the affected code and are affected. Exploitation is only possible where systemd-homed is actively used to manage user accounts (homectl-created users with the NSS systemd module enabled), which is not the default user-management configuration on Red Hat Enterprise Linux; this limits real-world exposure but does not remove the vulnerable code. Red Hat rates this Important because it permits a local, logged-in homed-managed user to escalate privileges to root.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not use systemd-homed to manage user accounts. Systems using the traditional /etc/passwd mechanism (the default on Red Hat Enterprise Linux) are not exploitable. Where systemd-homed is not required, ensure it is disabled (systemctl disable --now systemd-homed) and that the systemd NSS module is not present in /etc/nsswitch.conf.