CVE-2026-128886: Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path
A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because the server processes this verification without enforcing a timeout, the stalled connection blocks the accept process and prevents legitimate clients from establishing new connections.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial of service?
D-Bus servers configured to use the nonce-tcp transport are exposed if their listener can be reached by an unauthenticated attacker. The attacker must be able to open a connection to that listener.
What does an attacker need to do to trigger the issue?
The attacker opens a connection and withholds the expected authentication token. The server then waits during nonce verification without a timeout, stalling the accept process.
What is the operational impact of a successful attack?
Legitimate clients can be prevented from establishing new connections while the stalled connection blocks acceptance of additional connections. The reported impact is denial of service; no confidentiality or integrity impact is specified.