CVE-2026-16730
Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.
- Record
CVE-2026-16730- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-755
- Updated
- 2026-11-05
EUVDEUVD-2026-48559
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.
- Record
EUVD-2026-48559- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-77qf-9j4m-ph58
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE...
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.
- Record
GHSA-77qf-9j4m-ph58- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-755
- Updated
- 2026-11-02
NVD
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.
- Record
CVE-2026-16730- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-755
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-16730
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.
- Record
DEBIAN-CVE-2026-16730- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:61340
Red Hat Security Advisory: dbus-broker security update
- Record
RHSA-2026:61340- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVRHSA-2026:61355
Red Hat Security Advisory: dbus-broker security update
- Record
RHSA-2026:61355- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2026:61340
Moderate: dbus-broker security update
dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases.
Security Fix(es):
- dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup (CVE-2026-16730)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:61340- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2026:61355
Moderate: dbus-broker security update
dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases.
Security Fix(es):
- dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup (CVE-2026-16730)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:61355- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-16730
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.
- Record
UBUNTU-CVE-2026-16730- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2026:61340 No score
Moderate: dbus-broker security update
dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases.
Security Fix(es):
- dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup (CVE-2026-16730)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:61340- Updated
- 2026-11-02
OSVALSA-2026:61355 No score
Moderate: dbus-broker security update
dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases.
Security Fix(es):
- dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup (CVE-2026-16730)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:61355- Updated
- 2026-11-02
OSVCLSA-2026-1788817207 No score
dbus-broker: Fix of CVE-2026-16730
- CVE-2026-16730: bump RLIMIT_NOFILE to hard limit at broker startup to prevent fatal EMFILE during peer setup (DoS)
- Record
CLSA-2026-1788817207- Updated
- 2026-11-02
OSVCLSA-2026-1791316945 No score
dbus-broker: Fix of CVE-2026-16730
- CVE-2026-16730: bump RLIMIT_NOFILE to the hard limit at startup. This raises the session bus file-descriptor headroom from 1024 to 524288; the system unit sets a single LimitNOFILE=16384, so soft equals hard there and the bump is a no-op. accept4() in src/bus/listener.c still treats EMFILE/ENFILE as fatal, as upstream does.
- Record
CLSA-2026-1791316945- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dbus-brokerAlmaLinux:10 |
before 36-5.el10_2 | 36-5.el10_2 |
dbus-brokerAlmaLinux:9 |
before 28-9.el9_8 | 28-9.el9_8 |
dbus-brokerTuxCare:AlmaLinux:9.2 |
before 28-7.el9.tuxcare.els1 | 28-7.el9.tuxcare.els1 |
dbus-brokerTuxCare:AlmaLinux:9.6 |
before 28-7.el9_6.tuxcare.els1 | 28-7.el9_6.tuxcare.els1 |
dbus-brokerDebian:12 |
All versions, plus listed versions 33-134-135-135-1~bpo12+135-2 Show 10 moreShow less36-136-1~bpo12+136-236-2~bpo12+137-137-237-2~bpo12+137-337-437-5 |
None known |
dbus-brokerDebian:13 |
All versions, plus listed versions 37-237-337-437-5 |
None known |
dbus-brokerDebian:14 |
All versions, plus listed versions 37-237-337-437-5 |
None known |
dbus-brokerRed Hat:enterprise_linux:10.2 |
before 0:36-5.el10_2 | 0:36-5.el10_2 |
dbus-broker-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:36-5.el10_2 | 0:36-5.el10_2 |
dbus-broker-debugsourceRed Hat:enterprise_linux:10.2 |
before 0:36-5.el10_2 | 0:36-5.el10_2 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dbus-brokerRed Hat:enterprise_linux:9::baseos |
before 0:28-9.el9_8 | 0:28-9.el9_8 |
dbus-broker-debuginfoRed Hat:enterprise_linux:9::baseos |
before 0:28-9.el9_8 | 0:28-9.el9_8 |
dbus-broker-debugsourceRed Hat:enterprise_linux:9::baseos |
before 0:28-9.el9_8 | 0:28-9.el9_8 |
dbus-brokerRocky Linux:10 |
before 0:36-5.el10_2 | 0:36-5.el10_2 |
dbus-brokerRocky Linux:9 |
before 0:28-9.el9_8 | 0:28-9.el9_8 |
dbus-brokerUbuntu:22.04:LTS |
All versions, plus listed versions 29-129-329-429-4build1 |
None known |
dbus-brokerUbuntu:24.04:LTS |
All versions, plus listed versions 33-1ubuntu135-235-2ubuntu0.1 |
None known |
dbus-brokerUbuntu:26.04:LTS |
All versions, plus listed versions 37-237-337-437-5 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| products | CVE List | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-16730 is a medium vulnerability (CVSS 5.5) in Red Hat Enterprise Linux 10, published July 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in dbus-broker 36-5.el10_2.
References
access.redhat.com/errata/RHSA-2026:61340
bugzilla.redhat.com/show_bug.cgi?id=2506348
github.com/bus1/dbus-broker/issues/435
Show 15 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-16730
errata.almalinux.org/10/ALSA-2026-61340.html
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788817207.html
security-tracker.debian.org/tracker/CVE-2026-16730
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61340.json
cve.org/CVERecord?id=CVE-2026-16730
errata.rockylinux.org/RLSA-2026:61340
ubuntu.com/security/CVE-2026-16730