{"id":"CVE-2026-120749","kind":"vulnerability","aliases":["CVE-2026-120749"],"related":[],"title":"D-Bus: a local user can crash the bus daemon via monitoring","description":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.","summary":"When a privileged monitoring client such as dbus-monitor is attached, a local unprivileged user can make dbus-daemon abort by triggering a failed delivery of a driver broadcast. On the system bus this results in a denial of service.","severity":"medium","cvss":6.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dbus","infrastructure","linux","self-hosted","system-bus"],"not_affected_if":["no-monitoring-client-attached"],"how_to_check":"- `dbus-daemon --version` to see the installed D-Bus version\n- Check whether monitoring clients such as `dbus-monitor` or `busctl monitor` are attached on systems where the system bus is used\n- Fix versions: unknown","fix":null,"status":"open","published_at":"2026-11-06T07:17:06+00:00","first_seen_at":"2026-11-06T07:40:16+00:00","triaged_at":"2026-11-06T07:41:52+00:00","updated_at":"2026-11-06T07:41:52+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-06T07:41:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"D-Bus: a local user can crash the bus daemon via monitoring","impact":"low","summary":"When a privileged monitoring client such as dbus-monitor is attached, a local unprivileged user can make dbus-daemon abort by triggering a failed delivery of a driver broadcast. On the system bus this results in a denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux","dbus","system-bus","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"dbus-daemon aborts, causing denial of service on the system bus","analyst_note":"Find the affected and fixed D-Bus versions and whether a fix is released, from the upstream D-Bus advisory or the NVD entry.","how_to_check":"- `dbus-daemon --version` to see the installed D-Bus version\n- Check whether monitoring clients such as `dbus-monitor` or `busctl monitor` are attached on systems where the system bus is used\n- Fix versions: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-monitoring-client-attached"],"who_is_affected":"Systems running dbus-daemon, especially the well-known system bus, where a privileged monitoring client is attached and local users can send messages. The flaw is an incomplete fix for CVE-2023-34969. The sources do not state which versions are affected or fixed, nor whether the default configuration is exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000715,"input_tokens":4344,"output_tokens":562,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120749':16A,19A '-2023':163C '-2026':15A,18A '-34969':164C '0':139C,151C 'abort':50B,103C,153C 'activatableserviceschang':114C 'assert':148C 'assign':167C 'attach':40B,84C 'broadcast':59B,109C,135C 'bus':3A,10A,28B,63B,78C,183C 'busctl':91C 'cannot':115C 'caus':98C 'client':33B,83C 'compos':143C 'crash':8A 'cve':14A,17A,162C 'd':2A,77C 'd-bus':1A,76C 'daemon':11A,49B,101C,155C 'dbus':20B,37B,48B,88C,100C 'dbus-daemon':47B,99C 'dbus-monitor':36B,87C 'deliv':117C 'deliveri':55B,141C 'deni':126C 'denial':68B,187C 'driver':58B,107C,134C,170C 'driver-origin':106C 'due':123C 'error':146C 'exampl':86C,122C 'exceed':130C 'fail':54B,142C 'fix':160C 'flaw':72C 'found':74C 'host':25B 'incomplet':159C 'infrastructur':21B 'known':181C 'linux':22B 'local':5A,42B,95C 'make':46B 'messag':132C,171C 'monitor':13A,32B,38B,82C,89C,92C,145C 'nameownerchang':112C 'origin':108C 'outgo':131C 'privileg':31B,81C 'queue':133C 'recipi':120C,176C 'repli':147C,149C 'result':65B 'rule':127C 'self':24B 'self-host':23B 'sent':172C 'serial':138C,150C,168C 'servic':70B,189C 'singl':175C 'still':136C 'system':27B,62B,182C 'system-bus':26B 'trigger':52B 'unprivileg':43B,94C 'use':137C 'user':6A,44B,96C 'via':12A 'well':180C 'well-known':179C","nicknames":[],"mitigations":[],"who_affected":"Systems running dbus-daemon, especially the well-known system bus, where a privileged monitoring client is attached and local users can send messages. The flaw is an incomplete fix for CVE-2023-34969. The sources do not state which versions are affected or fixed, nor whether the default configuration is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dbus","infrastructure","linux","medium","selfhosted","systembus"],"campaign_type":null,"search_a":"'-120749':16A,19A '-2026':15A,18A 'bus':3A,10A 'crash':8A 'cve':14A,17A 'd':2A 'd-bus':1A 'daemon':11A 'local':5A 'monitor':13A 'user':6A 'via':12A","search_b":"'abort':50B 'attach':40B 'broadcast':59B 'bus':28B,63B 'client':33B 'daemon':49B 'dbus':20B,37B,48B 'dbus-daemon':47B 'dbus-monitor':36B 'deliveri':55B 'denial':68B 'driver':58B 'fail':54B 'host':25B 'infrastructur':21B 'linux':22B 'local':42B 'make':46B 'monitor':32B,38B 'privileg':31B 'result':65B 'self':24B 'self-host':23B 'servic':70B 'system':27B,62B 'system-bus':26B 'trigger':52B 'unprivileg':43B 'user':44B","search_c":"'-2023':163C '-34969':164C '0':139C,151C 'abort':103C,153C 'activatableserviceschang':114C 'assert':148C 'assign':167C 'attach':84C 'broadcast':109C,135C 'bus':78C,183C 'busctl':91C 'cannot':115C 'caus':98C 'client':83C 'compos':143C 'cve':162C 'd':77C 'd-bus':76C 'daemon':101C,155C 'dbus':88C,100C 'dbus-daemon':99C 'dbus-monitor':87C 'deliv':117C 'deliveri':141C 'deni':126C 'denial':187C 'driver':107C,134C,170C 'driver-origin':106C 'due':123C 'error':146C 'exampl':86C,122C 'exceed':130C 'fail':142C 'fix':160C 'flaw':72C 'found':74C 'incomplet':159C 'known':181C 'local':95C 'messag':132C,171C 'monitor':82C,89C,92C,145C 'nameownerchang':112C 'origin':108C 'outgo':131C 'privileg':81C 'queue':133C 'recipi':120C,176C 'repli':147C,149C 'rule':127C 'sent':172C 'serial':138C,150C,168C 'servic':189C 'singl':175C 'still':136C 'system':182C 'unprivileg':94C 'use':137C 'user':96C 'well':180C 'well-known':179C","first_public_at":"2026-11-06T07:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120749","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120749","severity":null,"published_at":"2026-11-06T07:17:06+00:00","modified_at":"2026-11-06T07:17:10+00:00","first_seen_at":"2026-11-06T07:40:16+00:00","fetched_at":"2026-11-06T07:40:16+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}