Loading story…
A public disclosure detailed that systemd-journald in systemd 259 fails to escape control characters in emergency-level messages forwarded with wall, allowing any local user to inject crafted escape sequences into other users’ terminals when ForwardToWall=yes and MaxWallLevel=emerg are enabled. The issue affects TTYs and some root-owned PTYs, letting attackers manipulate terminal output and potentially trigger unsafe behavior in terminal emulators that render the sequences.
Aaron Rainbolt showed that the flaw can be chained with XTerm behavior tied to CVE-2022-45063 to escalate privileges. In the demonstrated scenario, an unprivileged user sends a malicious emerg-level log message that reaches a root shell running in a vulnerable terminal, causing commands to execute in that privileged session and exposing sensitive files such as /etc/shadow. Suggested mitigations include disabling wall forwarding in journald.conf or via the kernel command line.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
The systemd-journald flaw affecting emerg-level messages forwarded via wall was assigned CVE-2026-40228. The identifier formalized the issue previously disclosed by Aaron Rainbolt, which can allow local users to inject terminal control sequences into other users' TTYs under affected configurations.
In an oss-sec follow-up, Aaron Rainbolt said the upstream issue reference was correct but had been deleted by systemd maintainers. He said upstream viewed the disclosure policy as irresponsible, while his email preserved the useful details from the removed report.
A follow-up explanation detailed how the journald flaw can be chained with XTerm behavior associated with CVE-2022-45063 to achieve privilege escalation. In the demonstrated scenario, a crafted emerg-level message injected commands into a root ZSH session and copied /etc/shadow to a location readable by the attacker.
Rainbolt publicly disclosed that systemd-journald in systemd 259 fails to sanitize emerg-level messages broadcast to other users' terminals, enabling terminal output manipulation and possible exploitation of vulnerable terminal emulators. The disclosure included a basic proof of concept and mitigation advice such as disabling wall forwarding.
Aaron Rainbolt reportedly disclosed to upstream that systemd-journald in systemd 259 does not escape dangerous character sequences in emerg-level messages forwarded via wall. The flaw can let a local user inject terminal escape sequences into other users' TTYs when ForwardToWall=yes and MaxWallLevel=emerg are enabled.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and vendors disclosed **CVE-2026-46333**, a Linux kernel flaw in `__ptrace_may_access()` that lets an unprivileged local user exploit a process-exit race to bypass authorization checks and steal file descriptors from privileged processes. The bug has existed since Linux `v4.10-rc1`, and exploitation became more practical with `pidfd_getfd()` introduced in `v5.6-rc1`. Qualys and public proof-of-concept authors showed the issue can expose `/etc/shadow`, leak OpenSSH host private keys through `ssh-keysign`, and in some cases execute commands as root via targets including `chage`, `pkexec`, and `accounts-daemon` on default Debian, Ubuntu, Fedora, AlmaLinux, and other distributions. Linus Torvalds merged the upstream fix in commit `31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a`, and stable kernel updates were released across multiple branches as distributions began shipping patched packages. Public exploit code appeared almost immediately after the fix became visible, increasing the urgency for defenders to patch and reboot affected systems, rotate potentially exposed **SSH host keys** and other credentials, and review systems for local privilege-escalation activity. Where immediate patching is not possible, several vendors and Qualys said raising `kernel.yama.ptrace_scope` to `2` or `3` can block known exploit paths, although maintainers cautioned that such settings are only a temporary workaround and may disrupt debugging tools.
Aug 25, 2026
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Aug 25, 2026
A vulnerability in **libinput**, the input device handling library used with **Wayland** and **X.Org Server**, can allow local privilege escalation to root by abusing how the library passes device attributes into **udev**. Researchers found that crafted newline characters in values associated with virtual devices created through `uinput` or `uhid` can inject unintended extra udev properties, including dangerous keys such as `REMOVE_CMD`, potentially leading to command execution as root when the device is processed or removed. The issue affects systems where non-root users can write to `/dev/uinput` or `/dev/uhid`, a capability that is normally restricted but may be exposed by permissive desktop-oriented udev rules or group memberships. Fedora was highlighted as an example where packages such as **steam-devices**, **antimicrox**, and **kdeconnectd** may open that path for local users. The vulnerability has been fixed in **libinput 1.31.3** and **1.30.4**, and exploitation requires local access plus the ability to create malicious virtual input devices.
Jun 29, 2026