Description
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Update Infrastructure 5 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dbus-broker | No fix yet | — |
| Debian 13 | dbus-broker | No fix yet | — |
| Debian 12 | dbus-broker | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | dbus-broker | No fix yet | — |
| Ubuntu 24.04 LTS | dbus-broker | No fix yet | — |
| Ubuntu 22.04 LTS | dbus-broker | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | dbus-broker | 36-5.el10_2 | RHSA-2026:61340 |
| RHEL 9 | dbus-broker | 28-9.el9_8 | RHSA-2026:61355 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | dbus-broker | 36-5.el10_2 | ALSA-2026:61340 |
| AlmaLinux 9 | dbus-broker | 28-9.el9_8 | ALSA-2026:61355 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | dbus-broker | 36-5.el10_2 | RLSA-2026:61340 |
| Rocky Linux 9 | dbus-broker | 28-9.el9_8 | RLSA-2026:61355 |
Advisories 7
- WID-SEC-2026-3095 Red Hat Enterprise Linux (pipewire,dbus-broker): Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 3, 2026
- ALSA-2026:61355 Moderate: dbus-broker security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:61340 Moderate: dbus-broker security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:61355 Red Hat Security Advisory: dbus-broker security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RHSA-2026:61340 Red Hat Security Advisory: dbus-broker security update Red Hat Security Advisories (RHSA) · Sep 11, 2026
- RLSA-2026:61340 Moderate: dbus-broker security update Rocky Linux Security Advisories · Sep 1, 2026
- RLSA-2026:61355 Moderate: dbus-broker security update Rocky Linux Security Advisories · Sep 1, 2026
References
- RHSA-2026:61340 vendor-advisory
- RHSA-2026:61355 vendor-advisory
- RHSA-2026:66018 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-16730 vdb-entry
- RHBZ#2506348 issue-tracking
- https://github.com/bus1/dbus-broker/issues/435