CVE-2026-16730 — Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, …
Published: 2026-07-24 · CVSS: 5.5 · CVSS 3.1
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7