Riskcovery

CVE-2026-16730

Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup

State
Published
Severity
5.5 Medium
Published
Jul 24, 2026
Updated
Sep 10, 2026
Reserved
Jul 23, 2026

Read the record on cve.org

Description

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hredhat

Weaknesses

  • CWE-755 Improper Handling of Exceptional Conditions

Affected Products

ProductVersions
Red Hat Enterprise Linux 10Red Hat
  • 0:36-5.el10_2 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:28-9.el9_8 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1788880445 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1788880464 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1788880456 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1788765051 and laterNot affected
Red Hat Update Infrastructure 5Red Hat
  • 1788880581 and laterNot affected
Red Hat Hardened ImagesRed Hat
    Red Hat OpenShift Container Platform 4Red Hat

      References

      Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.