The vulnerability in dbus-broker arises from improper handling of exceptional conditions when the process file-descriptor limit is reached. Specifically, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are treated as fatal failures, causing the broker process to exit unexpectedly. This behavior allows a local attacker with the ability to open numerous connections to the user session bus to cause a denial of service against the desktop session. The issue also affects Flatpak applications that can access the host session bus through the dbus proxy, expanding the attack surface within the local environment.

The impact is a denial of service (DoS) condition on the desktop session due to the dbus-broker exiting when file-descriptor limits are exceeded. There is no confidentiality or integrity impact reported. The vulnerability requires local access with low privileges and does not require user interaction. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-16730 for current remediation guidance. No official fix or workaround is currently documented. Until a fix is available, limiting the number of simultaneous connections to the user session bus or restricting access to Flatpak applications may reduce exposure.