systemd (249.11-0ubuntu3.21) jammy-security; urgency=medium

  * SECURITY UPDATE: MITM via DNSSEC-signed domains with no signature
    - debian/patches/CVE-2023-7008.patch: resolved: actually check authenticated
      flag of SOA transaction in src/resolve/resolved-dns-transaction.c.
    - CVE-2023-7008
  * SECURITY UPDATE: escape-to-host via malformed optional config file
    - debian/patches/CVE-2026-40226-1.patch: nspawn: apply BindUser/Ephemeral
      from settings file only if trusted in src/nspawn/nspawn.c.
    - debian/patches/CVE-2026-40226-2.patch: nspawn: normalize pivot_root paths
      in src/nspawn/nspawn-mount.c.
    - CVE-2026-40226

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 05 Jun 2026 11:40:28 -0400

systemd (249.11-0ubuntu3.20) jammy; urgency=medium

  * net_id: depending on new udev prop, include/exclude PCI domain from netif names
    (LP: #2134334)
  * network: support ID_NET_MANAGED_BY udev property
    (LP: #2133220)

 -- Robert Malz <robert.malz@canonical.com>  Tue, 24 Mar 2026 09:52:29 -0400

systemd (249.11-0ubuntu3.19) jammy-security; urgency=medium

  * SECURITY UPDATE: Local unprivileged user can overwrite stack in systemd
    - d/p/CVE-2026-29111-1.patch: path-util: backport path_startswith_full
    - d/p/CVE-2026-29111-2.patch: core/cgroup: avoid one unnecessary strjoina()
    - d/p/CVE-2026-29111-3.patch: core: validate input cgroup path more prudently
  * SECURITY UPDATE: Local root execution via malicious hardware devices
    - d/p/udev-check-for-invalid-chars-in-various-fields-received-f.patch
    - d/p/udev-fix-review-mixup.patch
    - No CVE number

 -- Nick Rosbrook <enr0n@ubuntu.com>  Fri, 13 Mar 2026 12:47:41 -0400

systemd (249.11-0ubuntu3.17) jammy; urgency=medium

  [ Nick Rosbrook ]
  * initramfs-tools: copy hwdb.bin to initramfs (LP: #2112237)
  * d/t/tests-in-lxd: drop patching workaround (LP: #2115263)
    - d/t/control: add Depends: dnsmasq-base
      (Revealed by test progressing past previous failure)

  [ Chengen Du ]
  * core/device: fix devlink handling (LP: #2100252)

 -- Nick Rosbrook <enr0n@ubuntu.com>  Tue, 26 Aug 2025 11:23:06 -0400

systemd (249.11-0ubuntu3.16) jammy-security; urgency=medium

  * SECURITY UPDATE: race condition in systemd-coredump
    - debian/patches/CVE_2025_4598_1.patch: coredump: get rid of
      _META_MANDATORY_MAX.
    - debian/patches/CVE_2025_4598_2.patch: coredump: use %d in kernel core
      pattern.
    - debian/patches/CVE_2025_4598_3.patch: coredump: get rid of a bogus
      assertion.
    - CVE-2025-4598

 -- Octavio Galland <octavio.galland@canonical.com>  Wed, 04 Jun 2025 11:17:43 -0300

systemd (249.11-0ubuntu3.15) jammy; urgency=medium

  * d/systemd.prerm: call d-s-h update-state for resolved on upgrades
    (LP: #2078555)

 -- Nick Rosbrook <enr0n@ubuntu.com>  Thu, 20 Feb 2025 08:24:02 -0500

systemd (249.11-0ubuntu3.14) jammy; urgency=medium

  [ Ioanna Alifieraki ]
  * network: skip to reassign master ifindex if already set
    (LP: #2003250)

  [ Nick Rosbrook ]
  * network: do not bring down a bonding port interface when it is already joined
    (This is a follow-up commit required for LP: 2003250)

  * networkd-test: skip test_resolved_domain_restricted_dns
    (LP: #2009859)

 -- Nick Rosbrook <enr0n@ubuntu.com>  Mon, 16 Dec 2024 15:23:18 -0500

systemd (249.11-0ubuntu3.13) jammy; urgency=medium

  [ Lukas Märdian ]
  * Fixing GRE6 and VTI6 on newer kernels (LP: #2037667)

  [ Nick Rosbrook ]
  * debian/tests/tests-in-lxd: update workaround patch (LP: #2055200)

  [ Chengen Du ]
  * udev: Handle PTP device symlink properly on udev action 'change'
    (LP: #2077779)

 -- Nick Rosbrook <enr0n@ubuntu.com>  Thu, 17 Oct 2024 10:26:55 -0400

systemd (249.11-0ubuntu3.12) jammy; urgency=medium

  * core/device: ignore DEVICE_FOUND_UDEV bit on switching root (LP: #2037281)
    File: debian/patches/lp2037281-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switching-roo.patch
    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=00f86f0b20f794f30aabe7181912d2ec2207e292
  * use read-only /etc hack in more places (LP: #2035122)
    File: debian/patches/debian/UBUNTU-Support-system-image-read-only-etc.patch
    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=c57406e850396a5d446aefe5e70a3aeaad080d72
  * autopkgtest: do not allow qemu to be used on ppc64el.
    Almost every run on ppc64el takes 12 to 24 hours, so do this as a last
    resort to relieve pressure on autopkgtest infrastructure.
    File: debian/tests/upstream
    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=d125a1ed3f01e59dba2f370c13801bfb76c16f5d

 -- Nick Rosbrook <enr0n@ubuntu.com>  Tue, 21 Nov 2023 15:57:17 -0500

systemd (249.11-0ubuntu3.11) jammy; urgency=medium

  * wait-online: exit early if all links are ignored (LP: #2036358)
    File: debian/patches/lp2036358-wait-online-exit-early-if-all-links-are-ignored.patch
    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=fcf9af1efaa904b9e587a3bfa76814d2601d05f3

 -- Nick Rosbrook <enr0n@ubuntu.com>  Tue, 19 Sep 2023 12:57:00 -0400

# For older changelog entries, run 'apt-get changelog libsystemd0'
