Two more systemd ships stable point releases today
Both v261.4 and v260.6 landed today within hours of each other, patched and padded with memory-safety fixes. One of them stays technically vulnerable if you're still on the 260 line.
Following today's systemd 262.1 release early in the morning, two additional stable point updates has been released today. The first, v261.4, hit the GitHub releases page at 13:12 UTC, carrying 207 commits over v261.3. Two hours later at 15:18 UTC came v260.6, with 179 commits over v260.5.
Both were pushed by the github-actions[bot] account as immutable releases. That's the part distros lean on. The release note itself says it plainly: "Immutable release. Only release title and notes can be modified." Once tagged, you can't quietly rewrite it, and reproducible builds depend on exactly that.
Both sit on baselines that already absorbed a big batch of security work. The 261.4 line is systemd's current feature track. The 260.6 line keeps the older 260 series current, the one famous for finally cutting System V init-script support back in March.
Keep in mind that neither release announced a brand-new CVE. systemd doesn't really do that for point releases anymore. The project folds the security fixes straight into the commit list and points you at GitHub Security Advisories instead.
What actually changed
A solid chunk of both releases covers the same bugs. That's normal for a maintenance drop, though it's still worth skimming.
Both lines picked up a fix for a one-byte buffer overflow in logind, a buffer-size miscalculation in udev rules, and integer-overflow guards when dissecting disk images. You'll also see seccomp masking tightened on socket(), setns(), and sched_setattr() calls. That matters because systemd is the process that spawns everything else on a typical box, so each overflow fix trims the blast radius of a local exploit.
Head to the v260.6 changelog here to work through all 179 commits yourself. The v261.4 list runs a touch longer at 207.
The one detail worth flagging
Here's the wrinkle. There's a CVE called CVE-2026-40227 that systemd defines as affecting the 260 line before 261. The fix shipped inside v261 itself, not inside later 260.x releases. So v260.6 sits on the vulnerable side of that specific bug, while v261.4 already has it locked down.
If you're pinned to systemd 260, that's an extra nudge to plan a migration to 261 or later. The newer line brings its own spoils too, like IMDS cloud metadata access, a new installer called systemd-sysinstall, and live kernel updates through the kernel's LUO/KHO mechanism.
That said, 260.6 still buys you time if you can't move yet. It's patched and hardened and current, at least.
Where to get them
The full notes and changelogs live on systemd's GitHub. Head here for systemd 260.6 and here for 261.4.
