A flaw in D‑Bus allows a local unprivileged user to cause dbus‑daemon to abort when a driver‑originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient. The daemon aborts because the monitoring client receives a reply with an unexpected serial, triggering an assertion failure. This results in a denial of service on the well‑known system bus.

The vulnerability affects Red Hat Enterprise Linux 6, 7, 8, 9 and 10, as well as Red Hat Hardened Images and the ELS streams for RHEL 6 and 7, as listed in the CNA vendor/product entries.

The CVSS score of 6.2 indicates a moderate severity. EPSS data is not available and the vulnerability is not listed in CISA KEV. Exploitation requires a privileged monitoring client such as dbus‑monitor or busctl monitor to be active on the same dbus‑daemon instance; without such a client the vulnerable code path is not reached. An attacker who can run a privileged monitoring process locally can cause a crash of dbus‑daemon, leading to a denial of service for any applications relying on the bus.