CVE-2026-16730: dbus-broker DOS Vulnerability

CVE-2026-16730 Overview

A denial-of-service flaw exists in dbus-broker, the high-performance implementation of the D-Bus message bus used on many Linux desktop systems. When the process file-descriptor limit is reached, EMFILE and ENFILE errors that occur during peer setup, notably during SO_PEERPIDFD acquisition, are treated as fatal. The broker exits instead of gracefully rejecting the offending connection. A local attacker with an active session can open many connections to the user session bus and trigger termination of the broker. Flatpak applications can reach the host session bus through the D-Bus proxy, widening the exposure surface. This vulnerability is categorized under [CWE-755] Improper Handling of Exceptional Conditions.

Critical Impact
A local, low-privileged attacker can crash the user session D-Bus broker, disrupting desktop session functionality and dependent inter-process communication.

Affected Products

dbus-broker (bus1/dbus-broker implementation)
Linux distributions shipping dbus-broker as the session bus (including Red Hat products per vendor advisory)
Sandboxed applications reaching the session bus via the D-Bus proxy, such as Flatpak

Discovery Timeline

2026-07-24 - CVE CVE-2026-16730 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-16730

Vulnerability Analysis

The flaw resides in the peer-setup path of dbus-broker. When a new client connects to the session bus, the broker attempts to associate metadata with the peer, including a pidfd retrieved via the SO_PEERPIDFD socket option. This operation allocates a file descriptor in the broker process.

When the broker has exhausted its file-descriptor allotment, the kernel returns EMFILE (per-process limit) or ENFILE (system-wide limit). The current code path classifies these transient, resource-related errors as unrecoverable and aborts. The failure mode is misclassification of a recoverable per-connection error as a fatal broker error.

Because the session bus is the coordination point for desktop services, its termination cascades into loss of notifications, portal services, and application integration. Sandboxed applications routed through the D-Bus proxy inherit access to this attack surface.

Root Cause

The root cause is missing graceful handling of EMFILE/ENFILE during peer initialization. The correct behavior is to reject the individual connection and continue serving existing peers. Instead, the broker propagates the error upward and exits, producing a denial-of-service condition rather than a bounded per-client failure.

Attack Vector

Exploitation requires local access with the ability to open sockets to the user's session bus. An attacker opens connections in a loop until the broker's file-descriptor limit is reached, at which point the next SO_PEERPIDFD call fails and the broker terminates. Flatpak-sandboxed processes with access to the D-Bus proxy can reach the host session bus and trigger the same condition.

// Verified code examples are not available for this CVE.
// See referenced advisories for technical details.

Detection Methods for CVE-2026-16730

Indicators of Compromise

Unexpected termination of the dbus-broker process on user sessions, followed by loss of desktop IPC functionality.
Log entries indicating EMFILE or ENFILE errors originating from dbus-broker around peer setup or SO_PEERPIDFD.
Sudden bursts of new connections to the user session bus from a single local user or sandboxed application.

Detection Strategies

Monitor dbus-broker exit codes and restart counts under systemd --user for anomalous crash-restart cycles.
Correlate journalctl --user -u dbus-broker.service output with process file-descriptor usage sampled from /proc/<pid>/fd.
Alert on rapid growth of open Unix domain sockets connected to the session bus socket path.

Monitoring Recommendations

Track per-process file descriptor consumption for dbus-broker and alert when it approaches configured LimitNOFILE.
Instrument endpoint telemetry to record local processes generating high-frequency connection attempts to $XDG_RUNTIME_DIR/bus.
Review Flatpak proxy logs for abnormal connection rates originating from sandboxed applications.

How to Mitigate CVE-2026-16730

Immediate Actions Required

Apply distribution updates for dbus-broker as they become available through the Red Hat CVE-2026-16730 Advisory and other vendor channels.
Restrict local, untrusted account access on affected multi-user systems until patches are deployed.
Audit Flatpak applications that use the D-Bus proxy to reach the host session bus and remove unnecessary bus access.

Patch Information

Refer to the upstream tracker at GitHub Issue #435 on D-Bus Broker and the Red Hat Bugzilla Report #2506348 for fix status. Distribution vendors will ship updated dbus-broker packages that treat EMFILE/ENFILE during peer setup as non-fatal.

Workarounds

Increase the file-descriptor limit for the dbus-broker user service via a systemd drop-in setting LimitNOFILE= to a higher value, reducing the ease of triggering exhaustion.
Configure systemd --user to automatically restart dbus-broker.service on failure to shorten downtime while a patch is pending.
Limit which sandboxed applications may talk to the session bus by tightening Flatpak D-Bus proxy filter rules.

bash

# Example systemd user drop-in to raise dbus-broker fd limit and enforce restart
# ~/.config/systemd/user/dbus-broker.service.d/override.conf
[Service]
LimitNOFILE=16384
Restart=on-failure
RestartSec=1s

# Apply changes
systemctl --user daemon-reload
systemctl --user restart dbus-broker.service