malcontent EUVD-2026-29921

A vendor-released patch is confirmed available per the SUSE advisory (https://security.opensuse.org/2026/05/11/malcontent-disk-space-dos.html); the exact fixed version number is not specified in available data and should be confirmed via the Bugzilla tracker at https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44931. Users running openSUSE or SUSE Linux Enterprise should apply available distribution updates via zypper or equivalent package manager. As a compensating control where patching is not immediately possible, administrators can restrict access to the malcontent D-Bus service by modifying its D-Bus policy configuration (typically in /etc/dbus-1/system.d/ or /usr/share/dbus-1/system.d/) to limit which users or groups may call the vulnerable interface - note this may break legitimate parental controls functionality. Alternatively, disabling or masking the malcontent daemon service (e.g., systemctl mask malcontent) removes the attack surface entirely if parental controls functionality is not required, though this disables all malcontent features.