Local Denial of Service Vulnerability in D-Bus by Freedesktop.org
CVE-2026-120749

6.2MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
6 November 2026

What is CVE-2026-120749?

A flaw in D-Bus allows an unprivileged local user to induce a denial of service by causing the dbus-daemon to abort. When a privileged Monitoring client is active, broadcast messages from drivers fail to be delivered, leading to an abort condition. This issue arises due to the handling of serials for driver broadcasts and is considered an incomplete fix for a previous vulnerability. The resulting failure impacts system stability on the well-known system bus.

References

https://access.redhat.com/security/cve/CVE-2026-120749
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2567978
issue-trackingx_refsource_REDHAT
https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests...

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Upstream acknowledges parkma99 as the original reporter.
.