CVE-2026-16730: Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-24 · updated 2026-09-10
Weakness: CWE-755

Description

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.

Affected products

Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Enterprise Linux 10: all versions — fixed in 0:36-5.el10_2
Red Hat Enterprise Linux 9: all versions — fixed in 0:28-9.el9_8
Red Hat Hardened Images: all versions
Red Hat Update Infrastructure 5: all versions — fixed in 1788765051, 1788880445, 1788880456, 1788880464, 1788880581

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:36-5.el10_2; Red Hat Enterprise Linux 9 0:28-9.el9_8; Red Hat Update Infrastructure 5 1788765051, 1788880445, 1788880456, 1788880464. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-16730 or the next vulnerability affects your stack