CVE-2026-44931: Malcontent-timerd DoS Vulnerability

CVE-2026-44931 Overview

CVE-2026-44931 is a resource exhaustion vulnerability in the malcontent-timerd service, a component of the malcontent parental controls framework. The flaw resides in the newly introduced RecordUsage D-Bus method implemented in child-timer-service.c within libmalcontent-timer. Any local user on the system can invoke this method to write data into /var/lib/malcontent-timerd, slowly filling the filesystem and producing a denial of service condition. The issue is tracked under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
Unprivileged local users can exhaust disk space in /var/lib/malcontent-timerd, causing a denial of service against the host filesystem.

Affected Products

malcontent 0.14.0 (libmalcontent-timer / malcontent-timerd)
openSUSE distributions shipping the affected malcontent package
SUSE Linux distributions packaging vulnerable malcontent builds

Discovery Timeline

2026-05-13 - CVE-2026-44931 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44931

Vulnerability Analysis

The malcontent-timerd daemon exposes a D-Bus interface that lets clients record application usage information for parental control accounting. The RecordUsage method, added in malcontent 0.14.0, accepts usage data from callers and persists it to disk under /var/lib/malcontent-timerd. The method does not impose per-caller quotas, rate limits, or size caps on the recorded data.

Because D-Bus system bus policies expose this interface to any local user, an unprivileged account can invoke RecordUsage repeatedly. Each call appends data to backing files owned by the service, gradually consuming free space on the partition hosting /var/lib. Once the filesystem fills, dependent services that require disk writes can fail, including logging, package management, and user session components.

The issue is classified under CWE-770 because the service allocates persistent storage on behalf of clients without enforcing limits. Refer to the malcontent source for child-timer-service.c for the affected implementation.

Root Cause

The RecordUsage handler trusts client-supplied input and writes it to disk without enforcing a maximum file size, throttling write frequency, or applying per-UID quotas. The D-Bus policy permits invocation by any local session, broadening the attack surface to every interactive and service account on the host.

Attack Vector

Exploitation requires only local access. An attacker authenticated to the system can connect to the system D-Bus and call the RecordUsage method on the malcontent-timerd service in a loop. Sustained calls grow files in /var/lib/malcontent-timerd until the partition is exhausted, denying disk-dependent services and user logins.

No verified public proof-of-concept code has been published. See the openSUSE Security Advisory and OpenWall OSS-Security Discussion for technical detail.

Detection Methods for CVE-2026-44931

Indicators of Compromise

Rapid growth of files and directories under /var/lib/malcontent-timerd beyond expected per-user accounting volumes.
Repeated D-Bus method calls to RecordUsage originating from a single local UID in short time windows.
Filesystem free-space alerts on the partition hosting /var/lib coinciding with malcontent service activity.

Detection Strategies

Monitor malcontent-timerd logs and the system journal for high-frequency RecordUsage invocations from non-administrative users.
Audit D-Bus traffic using dbus-monitor --system or busctl capture to baseline normal RecordUsage call rates and flag anomalies.
Track inode and byte growth in /var/lib/malcontent-timerd with file integrity tooling such as auditd watches on the directory.

Monitoring Recommendations

Configure disk usage thresholds for /var/lib and alert when malcontent storage exceeds expected baselines.
Forward auditd and journal records into a central log platform to correlate D-Bus activity with disk consumption events.
Review process accounting for unprivileged users issuing sustained gdbus call or busctl call commands targeting malcontent-timerd.

How to Mitigate CVE-2026-44931

Immediate Actions Required

Apply vendor updates from SUSE and openSUSE once published. Track status through the SUSE Bug Report for CVE-2026-44931.
Restrict access to the malcontent-timerd D-Bus interface using a system bus policy that limits RecordUsage to trusted UIDs or groups.
Place /var/lib/malcontent-timerd on a dedicated partition or apply filesystem quotas to bound the impact of abusive writes.

Patch Information

No fixed version is listed in the NVD record at publication time. Consult the openSUSE Security Advisory and distribution package repositories for updated malcontent builds that introduce throttling or size limits on the RecordUsage method.

Workarounds

Mask or disable the malcontent-timerd service on systems that do not use parental controls: systemctl mask malcontent-timerd.service.
Override the D-Bus policy file under /etc/dbus-1/system.d/ to deny RecordUsage for untrusted users until a patched package is installed.
Enforce per-user disk quotas on /var/lib to cap the storage any single account can consume through service-mediated writes.

bash

# Restrict access to the RecordUsage D-Bus method as a temporary mitigation
# /etc/dbus-1/system.d/malcontent-timerd-hardening.conf
<busconfig>
  <policy context="default">
    <deny send_destination="org.freedesktop.MalcontentTimer1"
          send_interface="org.freedesktop.MalcontentTimer1"
          send_member="RecordUsage"/>
  </policy>
  <policy user="root">
    <allow send_destination="org.freedesktop.MalcontentTimer1"
           send_interface="org.freedesktop.MalcontentTimer1"
           send_member="RecordUsage"/>
  </policy>
</busconfig>