CVE-2026-3836: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-3836 is a Denial of Service vulnerability in the dnf5daemon-server component of the dnf5 package manager, affecting Fedora 42. An unprivileged local user can exploit path traversal in the D-Bus locale configuration to crash the root-privileged daemon. The vulnerability was reported on March 9, 2026, and patched upstream in dnf5 version 5.4.1.0 on April 23, 2026. It carries a CVSS score of 7.5 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is improper input validation (CWE-22 — Path Traversal) in the open_session D-Bus method of dnf5daemon-server. When a caller passes a malicious or invalid string (e.g., ../../../../../tmp/PWNED) as the locale key, the underlying libdnf5 library invokes newlocale(), which fails and throws a libdnf5::SystemError. Because ThreadsManager::set_thread_locale does not catch this exception, it escapes the thread boundary and triggers std::terminate(), causing the root-privileged daemon to abort with a core dump. Exploitation requires only a local unprivileged user account and access to the System D-Bus — no special permissions or user interaction are needed (Red Hat Bugzilla). The fix, committed as ef98e1cc9a7b084a1ee70723206b3a5f450c48ee, implements locale string sanitization so that invalid locales fall back to the C locale rather than propagating an unhandled exception (Red Hat Bugzilla).

Successful exploitation causes dnf5daemon-server — a root-privileged process — to terminate abnormally via std::terminate(), resulting in a complete loss of availability for the system's package management daemon. This prevents any package operations (installation, updates, removal) from being performed until the daemon is restarted. While the primary impact is availability (DoS), the core dump produced may also expose sensitive memory contents to local users with access to crash artifacts (Red Hat Bugzilla, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The CVE status remains "Reserved" in the NVD. The attack requires local access to the target system and the System D-Bus, limiting the remote attack surface despite the CVSS network-based score. No CISA KEV listing or threat actor attribution has been identified (Red Hat CVE, Red Hat Bugzilla).

1. Gain local access: Obtain an unprivileged user account on a Fedora 42 system running a vulnerable version of dnf5daemon-server (prior to 5.4.1.0).
2. Access System D-Bus: Confirm access to the System D-Bus (typically available to all local users by default on Fedora).
3. Call open_session with malicious locale: Send a D-Bus method call to dnf5daemon-server's open_session method, supplying a crafted string as the locale parameter — for example, ../../../../../tmp/PWNED or any string not recognized as a valid locale by glibc.
4. Trigger unhandled exception: The daemon passes the string to newlocale() via libdnf5, which fails and throws a libdnf5::SystemError. Since ThreadsManager::set_thread_locale does not catch this exception, it propagates to the thread boundary.
5. Daemon crash: The uncaught exception invokes std::terminate(), causing the root-privileged dnf5daemon-server process to abort with a core dump, rendering the package management daemon unavailable (Red Hat Bugzilla).

• Logs: System journal entries (journalctl) showing dnf5daemon-server terminating unexpectedly with std::terminate() or SIGABRT; repeated daemon crash/restart cycles in systemd logs.
• File System: Unexpected core dump files (e.g., core.*) in the working directory of dnf5daemon-server or in /var/lib/systemd/coredump/, potentially containing memory artifacts from the root-privileged process.
• Process: Absence of the dnf5daemon-server process after a crash; systemd reporting the service as failed (systemctl status dnf5daemon-server).
• D-Bus: D-Bus audit logs (if enabled) showing open_session calls with anomalous or non-standard locale strings from unprivileged users (Red Hat Bugzilla).

The vulnerability is fixed in dnf5 version 5.4.1.0, released upstream on April 23, 2026, via commit ef98e1cc9a7b084a1ee70723206b3a5f450c48ee. Fedora 42 users should update the dnf5 package to the patched version using dnf upgrade dnf5. As a temporary workaround, restricting unprivileged user access to the System D-Bus or disabling dnf5daemon-server if not required can reduce exposure (Red Hat Bugzilla, Red Hat CVE).

Coverage of CVE-2026-3836 has been limited to security advisory aggregators and Linux-focused community sites. Linux Security and LinuxCompatible.org published advisories noting the Fedora 42 update, and a Portuguese-language blog post analyzed the vulnerability in the context of Fedora's software supply chain security. The German Linux news site Pro-Linux.de also covered the DoS risk. No notable researcher commentary or significant social media discussion has been identified (Linux Security, Pro-Linux).