CVE-2026-16730
Received Received - Intake

dbus-broker EMFILE/ENFILE DoS via Peer Setup Failure

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Red Hat, Inc.

Description
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-16730
EUVD
EUVD-2026-48559

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bus1 dbus-broker *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-755 The product does not handle or incorrectly handles an exceptional condition.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16730 is a denial-of-service vulnerability in dbus-broker. When the file-descriptor limit is reached, the broker crashes instead of handling errors gracefully. This happens when many connections are opened to the session bus, causing the broker to exit and disrupt the desktop session.

Detection Guidance

Monitor for dbus-broker crashes or session bus failures. Check system logs for 'Too many open files' errors or EMFILE/ENFILE messages. Use commands like 'journalctl -u dbus-broker' or 'dmesg | grep dbus-broker' to detect crashes. Test by opening many connections to the session bus and observing if the broker exits unexpectedly.

Check current file descriptor limits with 'ulimit -n' and monitor active connections using 'ls -l /proc/$(pidof dbus-broker)/fd | wc -l' to see if limits are being approached.

Impact Analysis

A local attacker or malicious Flatpak application could crash your desktop session by opening too many connections to the session bus. This would log you out or freeze your system until you restart it.

Compliance Impact

This vulnerability primarily causes a denial of service by crashing the session bus, disrupting desktop sessions. It does not directly impact data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. However, prolonged service disruption could indirectly affect compliance by hindering access to critical systems or data processing operations.

Mitigation Strategies

Increase the file descriptor limit for dbus-broker by editing systemd service files or using 'ulimit -n' in the service configuration. Restart dbus-broker after changes. Apply patches if available from your distribution. Monitor for crashes and adjust limits as needed.

Restrict Flatpak applications' access to the session bus if not required. Use 'flatpak override --user --nosocket=session-bus' to disable session bus access for specific applications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16730. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart