CVE-2026-120749 | BDVDB-2026-401158 Detail

Description#

A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-06Record published in the CVE List.
2. Version 22026-11-10Most recent update recorded in the CVE List.