CVE-2026-128885 · Infrastructure
NO FIX YET
In D-Bus builds that fall back to the Unix select() event loop, the daemon does not check whether file descriptor numbers exceed the allocated limit. A local attacker who opens many concurrent connections can trigger an out-of-bounds stack write that crashes the daemon.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only systems where the D-Bus daemon is configured to use the select() fallback for event monitoring are described as exposed; the sources do not say which default or distributions do this. Local users who can open connections to the bus are the attackers described. Systems using the default poll-based event loop are not stated to be affected.
Not affected if default-config, no-local-untrusted-users
Who cares dbus, linux, local-users
Unknown from the sources.
No fix yet, per the sources.
A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a large number of concurrent connections to trigger an out-of-bounds write on the stack. This can cause the daemon to crash, resulting in a Denial of Service (DoS).
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.