Systemd v261.5 lands as a stabilizing point release for cloud, live-update, and measured-boot features
The latest systemd-stable update tightens IMDS locked-mode networking and fixes service-manager reload races, but most of the headline features are already old news.
Systemd-stable v261.5 is out, and its job is to make a feature-heavy line a little less rough around the edges. Released as the fifth point release in the 261.x series, arriving just 19 days after v261.4. Quickest turn-around of the batch so far.
Let's back up for a moment. systemd is the process that becomes PID 1 when your Linux box boots. It starts services, manages mounts, tracks logs, detects hardware, and quietly holds together everything you only notice once it breaks. Created by Lennart Poettering and Kay Sievers, it's now the default init system on virtually every major distro, from Fedora and Debian to Ubuntu, and it powers much of the cloud as well.
Releases come in major lines and point releases. v261 opened the line in June 2026 with the big features. v261.5 is where those features get hardened and fixed. That's the whole story.
Head here for the raw commit if you want the diff. The tag is signed by release manager Luca Boccassi, commit 2b06553, "meson: bump version to 261.5", as is standard for systemd's cryptographically verified releases. The project is also still actively maintaining the 258, 259, 260, 261, and 262 lines at once.
What v261.5 is stabilizing
The volume is respectable without being overwhelming: 176 commits, 256 files changed, 50 contributors across the range. It's a steady point release, not a feature bombshell.
Now, the headline subsystems that v261.5 is polishing. These shipped earlier in the 261 line, so keep in mind they're context rather than new news.
First, the cloud metadata piece. systemd now ships systemd-imdsd, a local daemon that gives you a single, cached, rate-limit-tolerant entry point to the various cloud Instance Metadata Services. Before this, AWS, Azure, and GCP each ran their own HTTP endpoint for VM identity and credentials, and now there's one door to knock on.
A hardware database file recognizes clouds by SMBIOS data. The supported list is broad: Amazon EC2, Azure, Google Compute Engine, Hetzner, Oracle Cloud, Scaleway, Tencent Cloud, Alibaba ECS, and Vultr. Not bad for a first pass.
The design leans hard on security. systemd-imdsd can be the only service allowed to reach IMDS HTTP, with the rest of the hosts getting a blackhole route and polkit-gated access. Metadata gets measured into the TPM before it becomes a system credential. You can even lock down IMDS network access at build time via the -Dimds-network= meson option, though systemd warns this breaks traditional clients like cloud-init.
Then there's live update orchestration. v261 added native support for kexec with KHO and LUO, meaning a server can pass control from the old kernel to the new one and skip the whole hardware re-init dance. Normally a reboot re-initializes firmware and can eat minutes on a big box. This refreshes kernel and userspace at once.
Certain in-memory resources can now cross the kexec 1:1. Right now that's memfds. A service opts in with FileDescriptorStorePreserve=yes, so its runtime state survives an OS update without being serialized to disk. Data-center operators will recognize the payoff immediately: security updates without the full grey-out.
Measured boot gets a soft spot too. Machines without a physical TPM now get a software fallback via systemd-tpm2-swtpm.service, running IBM's swtpm. It's not ideal, but some software TPM beats none. Keys derive from a new "boot secret" that systemd-stub keeps in a persistent EFI variable readable only in the UEFI environment, not the OS, and passes it to the initrd via /.extra/boot-secret.
Other 261-line additions worth a mention: a new textual OS installer called systemd-sysinstall, a storagectl with the io.systemd.StorageProvider Varlink interface, and a fresh batch of security knobs including RestrictFileSystemAccess= and the fleet-scaling ConditionFraction=. The project also finished most of its migration to dlopen-based dynamic linking, leaving only libc directly linked so packagers can finally declare optional dependencies.
What's genuinely new in 261.5
Strip away the line-wide features and the actual v261.5 work is mostly about not breaking things, and doing it quietly.
The IMDS locked mode got tightened. Two commits turn off IPv4 reverse path filtering on IMDS links in locked mode and warn if that setting would break it. Without this the security posture just silently fails behind kernel routing checks. Not what you want.
The service manager reload races got fixed. Commits now refuse to hold back reload replies while the API bus is setting up, and refuse a Reload() while a reply is still pending. This stops the hangs and races that show up when you're reconfiguring services live.
systemd-vmspawn picked up virtio-bus detection, better QEMU error logging, and a split between QMP file descriptors and command-line ones. Minor, but VM-as-a-service is a growing use case.
There's also a wave of "log correct error" fixes scattered across the codebase. The commit messages read like a roll call: creds, cryptsetup, bootctl, pcrlock, logind, homed, homework, shutdown. A couple stop code from passing a success value as an error, which is the kind of thing that quietly masks real failures until something actually breaks.
DNS, network, and udev got smaller refinements: resolved returns NXDOMAIN for .onion domains, networkd preserves exact host-prefix pool addresses, and udev fixes USB device integration and validates the SMBIOS3 entry point length.
On the infra side, the project moved its Semaphore CI to Ubuntu LTS and shifted deb packaging to GitHub, with shared packaging pins across build tools. It's the sort of thing you don't see until it matters.
Why you should care
This isn't a release that'll make headlines. It's the opposite, and that's the point. systemd is doing exactly what mature infrastructure is supposed to do: absorbing the rough edges of a feature-heavy line and shipping the safest version of it.
For distro maintainers running the 261 line, v261.5 is the current sweet spot. It bundles the ambitious features with the fixes needed to actually run them. For data-center operators the kexec live-update work is a slow burn that pays off in uptime, and for cloud engineers the unified IMDS interface is a genuinely useful consolidation across a surprising number of providers.
Not cheap in the sense of being free of risk, but it's the kind of update you install and forget about. Which, for the backbone of modern Linux, is about the compliment you want to hear.
systemd-stable v261.5 is available now. Head here for the source tarball and signed tags.
