CVE-2026-16730 Details

A denial-of-service vulnerability has been identified in dbus-broker. When the process reaches its file-descriptor limit, errors during peer setup are treated as fatal, causing the broker to crash. This issue can be exploited by a local attacker who opens numerous connections to the user session bus, disrupting the desktop session. Notably, Flatpak applications can access the host session bus through the dbus proxy, potentially amplifying the impact of this vulnerability.

Users can manually increase the soft file descriptor limit for their session, but this vulnerability also requires a fix in the dbus-broker application itself. As of now, the latest version of dbus-broker includes the necessary fixes, but users may need to wait for their distribution to release an updated package.