CVE-2026-40226 · cross-distro fix matrix

CVE-2026-40226: It was discovered that systemd-nspawn incorrectly handled certain optional

Affects 3 Linux releases across 50 (distro × package) combinations. First disclosed: 2026-06-08.

Fix per ecosystem

Each block below is a distro release where CVE-2026-40226 has a known fix. Run the listed command on that distro to remediate.

Ubuntu jammy

Source: Ubuntu USN

systemd→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y systemd
```
libnss-myhostname→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y libnss-myhostname
```
libnss-mymachines→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y libnss-mymachines
```
libnss-resolve→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y libnss-resolve
```
libnss-systemd→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y libnss-systemd
```
libpam-systemd→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y libpam-systemd
```
libsystemd-dev→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y libsystemd-dev
```
libsystemd0→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y libsystemd0
```
libudev-dev→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y libudev-dev
```
libudev1→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y libudev1
```
systemd-container→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y systemd-container
```
systemd-coredump→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y systemd-coredump
```
systemd-journal-remote→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y systemd-journal-remote
```
systemd-oomd→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y systemd-oomd
```
systemd-repart→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y systemd-repart
```
systemd-standalone-sysusers→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y systemd-standalone-sysusers
```
systemd-standalone-tmpfiles→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y systemd-standalone-tmpfiles
```
systemd-sysv→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y systemd-sysv
```
systemd-tests→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y systemd-tests
```
systemd-timesyncd→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y systemd-timesyncd
```
udev→ fixed in249.11-0ubuntu3.21USN-8402-1
```
sudo apt-get install --only-upgrade -y udev
```

Ubuntu noble

Source: Ubuntu USN

systemd→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd

libnss-myhostname→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y libnss-myhostname

libnss-mymachines→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y libnss-mymachines

libnss-resolve→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y libnss-resolve

libnss-systemd→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y libnss-systemd

libpam-systemd→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y libpam-systemd

libsystemd-dev→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y libsystemd-dev

libsystemd-shared→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y libsystemd-shared

libsystemd0→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y libsystemd0

libudev-dev→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y libudev-dev

libudev1→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y libudev1

systemd-boot→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-boot

systemd-boot-efi→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-boot-efi

systemd-container→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-container

systemd-coredump→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-coredump

systemd-dev→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-dev

systemd-homed→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-homed

systemd-journal-remote→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-journal-remote

systemd-oomd→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-oomd

systemd-resolved→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-resolved

systemd-standalone-sysusers→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-standalone-sysusers

systemd-standalone-tmpfiles→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-standalone-tmpfiles

systemd-sysv→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-sysv

systemd-tests→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-tests

systemd-timesyncd→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-timesyncd

systemd-ukify→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-ukify

systemd-userdbd→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y systemd-userdbd

udev→ fixed in255.4-1ubuntu8.16USN-8402-1

sudo apt-get install --only-upgrade -y udev

Ubuntu questing

Source: Ubuntu USN

systemd→ fixed in257.9-0ubuntu2.5USN-8402-1

sudo apt-get install --only-upgrade -y systemd

Are YOU affected by CVE-2026-40226?

5-second check on your actual server. Reads /etc/os-release, uname -r, and the distro's package manager; matches against this same cross-source index live.

curl https://mindsparkstack.com/scan.sh | bash

Form-based quickscan View on NVD

Continuous monitoring beats manual checking

CVE-2026-40226dropped silently in your distro's update channel. Every new CVE is the same story. StackPatch runs the matcher hourly against all 5 sources and emails the exact remediation when something new applies to one of your servers. From $9/mo, 14-day free trial, cancel anytime.

See StackPatch (from $9/mo)