This vulnerability in dbus-broker arises from improper handling of exceptional conditions when the process file-descriptor limit is reached. Specifically, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are treated as fatal failures, causing the broker to exit. This leads to a denial of service on the user session bus, which can be triggered by a local attacker or a Flatpak application within the same user session by opening many connections. The flaw impacts Red Hat Enterprise Linux 10. Red Hat has not provided a fix or effective mitigation at this time.

The vulnerability causes the dbus-broker to terminate unexpectedly when file-descriptor limits are exhausted, resulting in a denial of service for the desktop session bus. This disrupts user sessions and can affect desktop usability. There is no impact on confidentiality or integrity. Exploitation requires local access or a compromised application within the same user session. No known exploits are reported in the wild.

Red Hat currently states that no mitigation meeting their criteria for ease of use, deployment, applicability, or stability is available. Users should monitor the Red Hat advisory for updates. Since no official fix or workaround is provided, limiting local access and controlling Flatpak application permissions may reduce exposure but are not formal mitigations.