From e64d5b6f231de717d158dea5c80ec21ca2de0bd6 Mon Sep 17 00:00:00 2001 From: Gerhard Schwanzer Date: Sun, 26 Jul 2026 15:21:05 +0200 Subject: [PATCH] dbus-broker: fix CVE-2026-16730 Backport both accepted upstream fixes to account peer pidfds and raise the broker soft RLIMIT_NOFILE to its hard limit. https://github.com/bus1/dbus-broker/pull/439 Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol) --- pkgs/by-name/db/dbus-broker/package.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkgs/by-name/db/dbus-broker/package.nix b/pkgs/by-name/db/dbus-broker/package.nix index 82528f959cf91..966afa25b6b4f 100644 --- a/pkgs/by-name/db/dbus-broker/package.nix +++ b/pkgs/by-name/db/dbus-broker/package.nix @@ -127,6 +127,16 @@ stdenv.mkDerivation (finalAttrs: { url = "https://github.com/bus1/dbus-broker/commit/fd5c6e191bffcf5b3e6c9abb8b0b03479accc04b.patch"; hash = "sha256-+QgZzm/qRnVSr0wDNw9Np3LRreRKl6CQXJextLPy6fc="; }) + (fetchpatch { + name = "CVE-2026-16730-1.patch"; + url = "https://github.com/bus1/dbus-broker/commit/c4a3c886366f7bd566ec9a55b3855ade8290fa17.patch"; + hash = "sha256-8O4YX83NI6ztS5oR2JY1++QrWLVCCSCNTpwcp2bu9LE="; + }) + (fetchpatch { + name = "CVE-2026-16730-2.patch"; + url = "https://github.com/bus1/dbus-broker/commit/aaa9fd6bbc2d5d7bfeca039f9c457b7f88a50dde.patch"; + hash = "sha256-f0p5oDw/6Wxe26fcqfKua766ylMg5NydywFM3MZYV8I="; + }) ]; nativeBuildInputs = [