CVE-2026-128987: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-128987 is a denial-of-service vulnerability in dbus (libdbus) caused by an infinite CPU-spin loop in the socket transport layer when an EPIPE error is received during write operations. A local, unauthenticated attacker can exploit this by connecting to an affected dbus service, triggering a queued response, and then halting socket reads while keeping the connection open, causing the target process to enter a continuous retry loop and exhaust CPU resources. The vulnerability was reported on April 26, 2026, and publicly disclosed on November 13, 2026, affecting the dbus-1.14.10-5.el10 package on Red Hat Enterprise Linux 10. It carries a CVSS v3.1 base score of 6.2 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition). In dbus/dbus-transport-socket.c, the do_writing() function treats EPIPE errors identically to EAGAIN/EWOULDBLOCK — as retryable — and returns without disconnecting the transport or clearing the queued outbound message. Subsequently, check_write_watch() re-enables the write watch whenever outgoing messages remain queued, perpetuating the retry loop with no forward progress. Exploitation requires local IPC/socket access to a process using the libdbus socket transport with a watch-driven event-loop integration; the attacker must be able to connect as a local client, trigger a queued reply (e.g., via a method call), and then call shutdown(fd, SHUT_RD) on the client socket to stop reads while keeping the connection open (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation results in a high-availability impact on the targeted dbus service process, which can be driven into persistent high CPU usage, effectively rendering it unresponsive. There is no confidentiality or integrity impact — the vulnerability is strictly a local denial-of-service condition confined to the security scope of the vulnerable process. Red Hat classifies the overall impact as Moderate, noting that the attack is constrained to local process CPU saturation without enabling privilege escalation or data compromise (Red Hat Advisory).

As of the disclosure date (November 13, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and a reachable watch-driven dbus endpoint, limiting the practical attack surface (Github Advisory, Red Hat Advisory).

1. Identify a target process: Locate a locally running process that uses the libdbus socket transport with a watch-driven event-loop integration (e.g., a system service on RHEL 10 using dbus-1.14.10-5.el10).
2. Connect as a local client: Using an unprivileged local account, connect to the target process's IPC/D-Bus socket endpoint.
3. Trigger a queued reply: Send a D-Bus method call or other request that causes the target process to queue an outbound reply message back to the client.
4. Stall socket reads: On the client side, call shutdown(fd, SHUT_RD) to stop reading from the socket, but keep the connection open so the server cannot detect a clean disconnect.
5. Observe CPU exhaustion: The target process repeatedly re-enters do_writing(), receives EPIPE, treats it as retryable, and re-arms the write watch — causing sustained high CPU consumption and denial of service for that process (Red Hat Bugzilla).

• Process: Abnormally high and sustained CPU usage by a dbus-linked service process (e.g., dbus-daemon or any service using libdbus), detectable via top, htop, or system monitoring tools.
• Logs: System logs (e.g., /var/log/messages, journald) may show the affected service becoming unresponsive or timing out; no specific error messages are generated by the infinite loop itself since EPIPE is silently retried.
• Network/Socket: Presence of a local socket connection to the affected dbus endpoint where the client-side socket has SHUT_RD applied but the connection remains open; observable via ss -xp or lsof showing a half-closed Unix domain socket connection to the service.
• System: Elevated load average on the host without a corresponding increase in legitimate workload, particularly tied to a specific dbus-dependent service PID (Red Hat Bugzilla).

A vendor-released package fix was not available at the time of disclosure; Red Hat states that no mitigation meeting their criteria for ease of use and deployment is currently available. The proposed upstream code fix involves adding an epipe_seen flag to DBusTransportSocket that, once set on EPIPE, prevents check_write_watch() from re-arming write activity for that connection. As interim workarounds, administrators should restrict untrusted local users from connecting to affected dbus socket or bus endpoints using access controls (e.g., D-Bus policy files, filesystem permissions on Unix sockets), and monitor for high CPU usage by dbus-linked processes, restarting affected services if a DoS is suspected (Red Hat Advisory, Red Hat Bugzilla).

Red Hat classified the vulnerability as Moderate severity, emphasizing that exploitation is constrained to local denial of service without privilege escalation or data exposure. The vulnerability was acknowledged to "Aisle Research" per the Red Hat Bugzilla entry. No significant broader media coverage or notable researcher commentary beyond the official Red Hat and GitHub advisory channels has been observed at this time (Red Hat Advisory, Red Hat Bugzilla).