CVE-2026-120749 · Infrastructure
NO FIX YET
When a privileged monitoring client such as dbus-monitor is attached, a local unprivileged user can make dbus-daemon abort by triggering a failed delivery of a driver broadcast. On the system bus this results in a denial of service.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Systems running dbus-daemon, especially the well-known system bus, where a privileged monitoring client is attached and local users can send messages. The flaw is an incomplete fix for CVE-2023-34969. The sources do not state which versions are affected or fixed, nor whether the default configuration is exposed.
Not affected if no-monitoring-client-attached
Who cares dbus, linux, self-hosted, system-bus
dbus-daemon --version to see the installed D-Bus versiondbus-monitor or busctl monitor are attached on systems where the system bus is usedNo fix yet, per the sources.
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.