Executive brief
A vulnerability in dbus-broker, a core component used for communication between applications on Linux systems, allows a local user to crash the entire desktop session. By opening a large number of connections to the system's message bus, an attacker can exhaust available resources and force the broker to shut down. This results in a denial of service where the user is effectively logged out and active applications may fail.
Technical details
A flaw exists in dbus-broker's handling of exceptional conditions during peer connection setup. When the process reaches its file-descriptor limit, system calls such as getsockopt(SO_PEERPIDFD) return EMFILE or ENFILE errors. Instead of gracefully refusing the new connection, dbus-broker treats these as fatal errors and exits. A local attacker, including one within a Flatpak sandbox, can exploit this by opening numerous connections to the user session bus to trigger the crash. This results in a complete denial of service for the affected user's desktop session.
Affected products
- Red Hat Red Hat Enterprise Linux 9 All versions
- Red Hat Red Hat Enterprise Linux 10 All versions
- bus1 dbus-broker Up to 37
Timeline
- 2026-05-14: other: Issue first reported on GitHub
- 2026-07-23: disclosed: Bug reported to Red Hat Bugzilla
- 2026-07-24: advisory: CVE published to NVD