CVE-2026-3836 describes a path traversal vulnerability in the dnf5daemon-server used in Red Hat Hardened Images. The flaw allows a local attacker with low privileges and access to the System D-Bus to supply a crafted locale configuration string during session initialization. This triggers the daemon to crash, causing a denial of service. The vulnerability is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Red Hat has issued an advisory (RHSA-2026:7349) describing this issue but currently does not provide a fix or effective mitigation. The vulnerability impacts availability but does not affect confidentiality or integrity.

The vulnerability allows a local, unprivileged attacker to cause the dnf5daemon-server to terminate unexpectedly, resulting in a denial of service condition with a core dump. There is no impact on confidentiality or integrity. The attack requires local access and low complexity, but no user interaction. This could disrupt package management operations relying on dnf5daemon-server, affecting system availability.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates and consider restricting local access to the System D-Bus where feasible. Applying updates when a fix becomes available is recommended.