A local denial of service against `dbus-daemon --system` was reported
upstream. I will provide more details here when the upstream issue is
unembargoed, which I will do after releasing a fixed version. Currently
no CVE ID is available.

All versions are believed to be vulnerable. The denial of service is
addressed by 1.16.4, which I plan to release shortly.

If the security team wants to issue a DSA for this and other recent
denial-of-service vulnerabilities, my suggestion would be to repackage
the 1.16.4 release for trixie.

    smcv

We believe that the bug you reported is fixed in the latest version of
dbus, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1153842@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon McVittie <smcv@debian.org> (supplier of updated dbus package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 12 Nov 2026 17:45:25 +0000
Source: dbus
Architecture: source
Version: 1.16.4-1
Distribution: unstable
Urgency: medium
Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Closes: 1153841 1153842
Changes:
 dbus (1.16.4-1) unstable; urgency=medium
 .
   * New upstream release fixing several local denial-of-service issues
     - Prevent local attacker from making `dbus-daemon --system` cause
       excessive single-CPU load
       (RHEL-239613, dbus#587; Closes: #1153842)
     - Prevent local attacker from crashing `dbus-daemon --system`
       if a privileged user is using monitoring tools on it
       + Mitigation: The vulnerability is not exploitable unless a
         privileged user is using monitoring tools
       (CVE-2026-120749; Closes: #1153841)
     - Prevent local attacker from making dbus-daemon or DBusServer
       unresponsive if configured to listen on the nonce-tcp: transport
       + Mitigation: The nonce-tcp: transport should not be used on
         multi-user systems
       (RHEL-239294, dbus#586; Closes: #1153842)
     - Prevent additional denial-of-service issues on non-Linux platforms
   * d/control: Update short description of dbus-user-session
   * d/control: dh-sequence-installsysusers is enabled by default
     in compat 14, stop enabling it explicitly
Checksums-Sha1:
 c8b5dfc355c368e008bbf47c98510cd72e0cbf57 4165 dbus_1.16.4-1.dsc
 b04dbe37d49f0f0e168f9a978239fff83ff2ef71 1124660 dbus_1.16.4.orig.tar.xz
 b365fd4359a55dca3df5fbaad9952d0de49aa560 833 dbus_1.16.4.orig.tar.xz.asc
 a340f51da4d6f5310cb1eeea4966d872f0c4a7b4 72504 dbus_1.16.4-1.debian.tar.xz
 3acb8c7e5e193c92fa37d859d9a54df11356afde 2729276 dbus_1.16.4-1.git.tar.xz
 5bec1f4de40b3d884ab0f23c9db29302fe72676c 17734 dbus_1.16.4-1_source.buildinfo
Checksums-Sha256:
 b0780380130c8fe75853108b5a9d35eddc70aa63ebda07090fd52321a0c6a30f 4165 dbus_1.16.4-1.dsc
 d08b05526c2cb7966a5fb79210d6112b1aca3d135f315c1b302e14b4b0297dac 1124660 dbus_1.16.4.orig.tar.xz
 7fec4d446090304ee8c97fa6c066c2c01ba09cd930cfa33939626023971b3168 833 dbus_1.16.4.orig.tar.xz.asc
 29dce1c7cca43cfc917c0502420e3f2525aa159686b1b22dd4f1bfc7400cea56 72504 dbus_1.16.4-1.debian.tar.xz
 904ae6b59eb1ec86076992552e15e351409aac5b0f9586987a3bccfdbdba75ef 2729276 dbus_1.16.4-1.git.tar.xz
 6b6d62466b5e90ad3e310b7312d913068fad6834861af8c8178edd195d80d234 17734 dbus_1.16.4-1_source.buildinfo
Files:
 81d32d60bfe1e7b6696e0ec00dbd0eca 4165 admin optional dbus_1.16.4-1.dsc
 b7ed0057777e1aa1bca3348e1aaeedb2 1124660 admin optional dbus_1.16.4.orig.tar.xz
 dd5a13979d179009aed3eee1aed86954 833 admin optional dbus_1.16.4.orig.tar.xz.asc
 15d99759b583518e7da553ffe8dce321 72504 admin optional dbus_1.16.4-1.debian.tar.xz
 155ad681dc4dff6ee79b3e7791c074ae 2729276 admin None dbus_1.16.4-1.git.tar.xz
 d680481e523f09eef358bc331db886b9 17734 admin optional dbus_1.16.4-1_source.buildinfo
Git-Tag-Info: tag=1731cda884e8b9ce83398a361edac99bba12e84b fp=7a073ad1ae694fa25bff62e5235c099d3eb33076
Git-Tag-Tagger: Simon McVittie <smcv@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmr1/REACgkQYG0ITkaD
wHn9EQ//RTWgVi92CjUsnQPBylsBxTA3iPdoBTEUmVyfRWHgJstgMa23kEdXBIJ0
Sr7kRhqKR7KoT4bObyS6LZ5Kt6jebk0n3cIMUNecz19MsdEcb6VWyS6C4uj54L+3
qncGlQR/EfMqtNttRVJ6WMr35sHHuKdItHxZkkKtH0cEgrLWITVn+F8a3kyP8xhA
BV3gYM6lx62pyeEcYZuMA1CN3GCy+CQAk73/uLg2kqX6S6TSYtQKLCCzLzFlK11r
fY5BgCENLZ7l8h5Zmu2XebsI+BADuVHhdo6p4n4CoAWZq2pUm1RHo+xGev0TmJFT
2FcyHX/8PLuUcEIP0KFjM9wTIt6VtOHBuvcQqDJ+/CTmx6poGUxXHEfKPDeGUmaf
ZUoo1Pxap9uLnFQLzKdrhYnigwhDepiI3QbYD4RhkN4Q5Wqz7qpxnRK06VrBhrcr
pBZC9CEdUBRMAQCbycDurlgswPwwIyDyETsST14jPZYUyOVrMPLp8C//N4Q86eFG
10dGImVLZPV6OVo+AdVHaFf/0OKPaFBEpR01TEwcLrvxSyQ2RDGAaFXCbIjptbMs
trAOBJRLFrHuHf/dCNu28pRhNcP6ZAE1P7nmF0kOg3XiMpXxSbdlak1KQpQUYTig
rbOYuo7H43B7gdU6mI0hI4Fb5/5bLd6z8Ac5QRiEt6XooZ0Kk70=
=ki+F
-----END PGP SIGNATURE-----

Control: retitle -1 dbus: RHEL-239613, dbus#587: local denial of service via EPIPE

A local attacker can connect a socket to a D-Bus server such as
`dbus-daemon --system`, then shut down the reading side of the socket with
shutdown() to trigger an EPIPE error in the server. The server repeatedly
retries reading from the attacker's socket, resulting in a busy-loop
(up to 100% load on one CPU core) until the attacker is disconnected.

Mitigation: Terminating the attacker process should return the D-Bus
server to normal. The dbus-daemon is single-threaded, so attacking
`dbus-daemon --system` in this way does not load more than one CPU core
on a multi-core system.

Vulnerable versions: all

Fixed versions: ≥ 1.16.4

Reported by AISLE in partnership with Red Hat.

A CVE ID has been requested from Red Hat's CNA but is not yet
available. Please do not request CVE IDs from other sources for this issue.