CVE-2026-120749

Name	CVE-2026-120749
Description	A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dbus (PTS)	bookworm	1.14.10-1~deb12u1	vulnerable
	trixie	1.16.2-2	vulnerable
	forky, sid	1.16.2-8	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
dbus	source	(unstable)	(unfixed)

Notes

[trixie] - dbus <no-dsa> (Minor issue)
https://gitlab.freedesktop.org/dbus/dbus/-/work_items/576
https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/565
https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/592