CVE-2026-16730 in Red Hat
Summary
by MITRE • 07/24/2026
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability in dbus-broker represents a critical denial of service weakness that stems from inadequate error handling during peer connection establishment. This flaw manifests when the system reaches its process file-descriptor limit, causing the broker to terminate unexpectedly rather than gracefully managing resource exhaustion conditions. The specific error conditions involved include EMFILE and ENFILE errors that occur during setup operations, particularly when processing SO_PEERPIDFD socket options. These errors are not properly categorized as recoverable failures but instead trigger immediate process termination, creating a pathway for malicious actors to disrupt desktop session services.
The technical implementation flaw resides in the broker's failure to distinguish between fatal and recoverable error conditions during peer establishment phases. When file descriptor limits are exhausted, the system should ideally implement graceful degradation or connection queuing mechanisms rather than abrupt process termination. This behavior violates established principles of robust system design where resource exhaustion scenarios should not result in complete service failure but instead trigger appropriate fallback mechanisms. The vulnerability is particularly concerning because it affects user session buses where desktop applications and services depend on continuous availability.
Operational impact of this vulnerability extends beyond simple service disruption to encompass broader desktop session reliability issues. A local attacker with sufficient privileges to establish numerous connections can systematically exhaust file descriptor limits and force the broker to exit, thereby denying access to critical desktop services and applications. The attack vector becomes more sophisticated when considering that Flatpak applications can access the host session bus through dbus proxy mechanisms, potentially allowing unprivileged users or malicious applications to leverage this vulnerability across application boundaries. This creates a multi-layered threat scenario where desktop session stability is compromised through indirect means.
The security implications align with CWE-400 weakness classification related to resource exhaustion and improper error handling patterns. From an ATT&CK framework perspective, this vulnerability maps to privilege escalation and denial of service tactics, potentially enabling attackers to maintain persistent access to desktop environments while disrupting legitimate user activities. Mitigation strategies should include implementing proper error handling for file descriptor limits with graceful degradation mechanisms, establishing connection rate limiting policies, and configuring appropriate system resource limits that prevent single processes from exhausting available file descriptors. Additionally, the dbus-broker implementation should be updated to properly handle EMFILE/ENFILE conditions as recoverable errors rather than fatal failures, ensuring continued operation even under resource-constrained conditions while maintaining service availability for legitimate users.