REDHAT-BUG-2567978: Security vulnerability

Published Nov 5, 2026

Updated

A flaw was found in dbus. This is an incomplete fix for CVE-2023-34969. On multi-user buses such as dbus-daemon --system, if a privileged user has attached a monitoring process such as dbus-monitor or busctl monitor to the system bus, an unprivileged user can trigger a dbus-daemon crash, resulting in a denial of service.

Upstream reference: https://gitlab.freedesktop.org/dbus/dbus/-/workitems/576

Reported via PSIRTSUPT-26737 by Simon McVittie.

Affected Software

0 affected components

Event History

Nov 5, 2026

Data Sourced

via Red Hat·10:55 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this denial-of-service condition?

The issue affects multi-user D-Bus buses, such as a system bus started with dbus-daemon --system, when a privileged user has attached a monitoring process such as dbus-monitor or busctl monitor.

What access does an attacker need to trigger the crash?

An unprivileged user must be able to interact with the affected multi-user bus. Exploitation also depends on a privileged user already having a monitoring process attached to that bus.

Is a default system-bus deployment necessarily affected?

The provided information only identifies systems as affected when a privileged monitoring process is attached. It does not establish that the condition exists in every default system-bus configuration.

REDHAT-BUG-2567978: Security vulnerability

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this denial-of-service condition?

What access does an attacker need to trigger the crash?

Is a default system-bus deployment necessarily affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this denial-of-service condition?

What access does an attacker need to trigger the crash?

Is a default system-bus deployment necessarily affected?