News › linux
By The Linux Camp News, September 24, 2026
The September 22 release changes build configuration, withdraws DNS-SD registrations when clients disconnect, and introduces TPM credential binding that older systemd versions cannot read.
Systemd v262 was released upstream on September 22, 2026. It adds an optional single statically linked binary build, which LWN highlights for small containers. For engineers building those images, this is a new packaging choice rather than a requirement to change existing installations. 1 2
Build maintainers should check their Meson configuration: -Dbuild-executor-shared=single is replaced by -Dsystemd-multicall-binary=true. The -Dstandalone-binaries= option now takes comma-separated patterns selecting which .standalone binaries to install, rather than a Boolean. Old true/false settings still translate to the previous defaults, but are deprecated. Upstream requires recreating existing Meson build directories that used the old options, so changing the configuration flags alone is not the complete migration. 2
Systemd-resolved changes the lifetime of DNS Service Discovery registrations made through its D-Bus RegisterService() method. The registering client's bus connection now controls how long the service remains registered: disconnecting removes it automatically. Previously, broken client tracking left registrations behind until resolved exited. This is a correction to the intended behavior, not the removal of durable registration storage; the old registrations did not survive a daemon restart either. 2
That correction changes one-shot registration workflows. Check scripts using busctl or gdbus: their registrations will disappear when the tool exits. A client must keep its bus connection open while its service should remain registered. For registrations independent of a client's lifetime, upstream directs operators to .dnssd files instead. 2
TPM-sealed credentials also gain a compatibility boundary. They are now pinned to the TPM's storage root key, or SRK. Upstream says protecting communication with a private key known only to the original TPM prevents an interposed attacker from stealing decrypted credentials. New systemd still accepts old credentials, but older systemd cannot recognize newly minted TPM-bound credentials. The operational inference is that rollback testing must cover credential creation as well as software replacement: keeping old software available does not make new credentials readable by it. 2