Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120749— Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus

Quick assessment

Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 D-Bus 中发现了一个漏洞。当存在一个具有特权的监控客户端（例如 dbus-monitor 或 busctl monitor）已连接时，非特权本地用户可通过触发由驱动程序发起的广播消息（如 NameOwnerChanged 或 ActivatableServicesChanged）无法送达接收方的情况（例如由于拒绝规则或出站消息队列已满），导致 dbus-daemon 进程终止。驱动程序广播消息仍使用序列号 0；当消息投递失败时，构造监控错误回复过程中会断言 reply_serial != 0，从而引发守护进

CVSS 6.2 · Medium

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120749

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可达断言
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Enterprise Linux 10 - cpe:/a:redhat:enterprise_linux:10
Red Hat Red Hat Enterprise Linux 6 - cpe:/o:redhat:rhel_els:6
Red Hat Red Hat Enterprise Linux 7 - cpe:/o:redhat:rhel_els:7
Red Hat Red Hat Enterprise Linux 8 - cpe:/a:redhat:enterprise_linux:8
Red Hat Red Hat Enterprise Linux 9 - cpe:/a:redhat:enterprise_linux:9
Red Hat Red Hat Hardened Images - cpe:/a:redhat:hummingbird:1

II. Public POCs for CVE-2026-120749

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120749

请登录查看更多情报信息。

Other References for CVE-2026-120749 (5)

Same Patch Batch · Red Hat · 2026-11-06 · 15 CVEs total

CVE-2026-109081 6.8 MEDIUM Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr
CVE-2026-19688 6.8 MEDIUM Keycloak-services: keycloak-services: admin api missing audience check
CVE-2026-123037 6.7 MEDIUM Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privi
CVE-2026-96547 6.5 MEDIUM Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging
CVE-2026-97848 6.5 MEDIUM Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sa
CVE-2026-9797 6.5 MEDIUM Keycloak: keycloak: privilege escalation via client authentication manipulation by an auth
CVE-2026-107124 6.4 MEDIUM Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_h
CVE-2026-97367 6.4 MEDIUM Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account re
CVE-2026-96460 5.4 MEDIUM Keycloak-services: keycloak-services: indefinite access token renewal via standard token e
CVE-2026-92856 4.9 MEDIUM Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation cons
CVE-2026-121837 4.3 MEDIUM Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored fo
CVE-2026-96447 4.2 MEDIUM Keycloak-services: keycloak-services: stateless token preferred_username fallback enables
CVE-2026-83493 Distributed-workloads: github actions pinned by mutable tag/branch, including third-party
CVE-2026-83494 Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10
Same vendor: Red Hat
Same weakness: CWE-617