CVE-2026-128885: Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize
A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a large number of concurrent connections to trigger an out-of-bounds write on the stack. This can cause the daemon to crash, resulting in a Denial of Service (DoS).
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects D-Bus daemon configurations that fall back to the Unix select() mechanism for event monitoring. Configurations not using that fallback are not identified as affected by the provided information.
What does an attacker need to exploit it?
The attacker needs local access and the ability to open a large number of concurrent connections so that file descriptor numbers exceed the allocated select() limits. No user interaction is required.
What is the expected impact of successful exploitation?
Exploitation can cause a stack out-of-bounds write that crashes the D-Bus daemon, resulting in denial of service. The provided information does not identify confidentiality or integrity impact.