An unprivileged user with a running desktop graphical session on a system where systemd-machined is at least version 259 (or 258 with a custom polkit rule granting the register‑machine action) can use the systemd API to terminate any process, including those owned by privileged users. The vulnerability is an access‑control bypass (CWE-284) that removes the boundary preventing ordinary users from sending kill signals to privileged processes. This can result in loss of service or unwanted process termination, potentially compromising system availability if key services are stopped.

The flaw affects systemd-machined 259 and newer, and version 258 only when a local polkit policy grants unprivileged users the register‑machine action. Versions older than 258 are not affected. The issue occurs only on desktop systems where systemd-machined is installed, which is typically an optional separate package such as systemd‑container; it is not installed by default and is not part of the core systemd service manager. Terminal‑only or remote sessions such as SSH do not trigger the vulnerability.

The CVSS score of 4.7 indicates a moderate risk. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local desktop session; the attacker must be logged in to a user’s graphical environment with systemd-machined running. Exploitation requires only the ability to issue kill requests via the systemd interface, with no need for elevated privileges. Based on the description, it is inferred that terminating privileged processes may lead to denial of service or disruption of critical applications, but there is no explicit evidence of privilege escalation. The overall exploitability is low to moderate due to the local nature of the attack and the requirement for the user to be in a graphical session.