---
id: CVE-2026-120749
title: >-
  Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast
  from the driver cannot be delivered to a monitored bus
summary: >-
  A flaw was found in D-Bus. With a privileged Monitoring client attached (for
  example dbus-monitor or busctl monitor), an unprivileged local user can cause
  dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged
  or …
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-617
vendor: Red Hat
product: dbus
affected:
  - dbus
  - dbus
  - dbus
  - dbus
  - dbus
  - dbus
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T06:56:57.944Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120749'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-120749'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2567978'
    label: RHBZ#2567978
  - url: 'https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/565'
  - url: 'https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/592'
  - url: 'https://gitlab.freedesktop.org/dbus/dbus/-/work_items/576'
tags:
  - cve.org
ingestedAt: '2026-11-06T07:47:15.877Z'
---

## Overview

A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.

## Affected

- `dbus`
- `dbus`
- `dbus`
- `dbus`
- `dbus`
- `dbus`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

This can only be done if a monitoring process such as dbus-monitor or busctl monitor is active on the same dbus-daemon instance, which is a privileged operation that can only be done by root or the Unix uid of the message bus. If no monitoring process is active, then the vulnerable code is not reached.