CVE-2026-120749
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
47/100
Published: 2026-11-06
Modified: 2026-11-13
First seen: 2026-11-06
Status: active
Attack Surface
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon.
Weakness Classification (1)
References & Advisories (6)
vendor-advisory
x_refsource_REDHAT