CVE-2026-78422
Received Received - Intake

Integer Overflow in zbus_polkit Subject Handling

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: SUSE

Description
Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i). Because of this type mismatch, polkit silently discards the caller-supplied UID and instead determines the subject's owner itself by looking up the PID in /proc, a lookup that is inherently subject to a time-of-check/time-of-use race. Consequently, an application that passes a UID obtained from a trustworthy source — for example SO_PEERCRED Unix socket peer credentials — in order to defend against PID reuse receives no protection, and the supplied UID has no effect on the authorization decision. A local unprivileged attacker who can cause an authorized process to terminate and then win the race to have their own process assigned the same PID can be authorized under the identity of the terminated process, bypassing the polkit authorization check and performing actions the attacker is not entitled to. This issue affects zbus_polkit before 5.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-78422
EUVD
EUVD-2026-68593

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-686 The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a type mismatch in the zbus_polkit crate where the UID of a Unix process is encoded as an unsigned 32-bit integer instead of the required signed 32-bit integer in Polkit's D-Bus protocol. This causes Polkit to ignore the provided UID and perform an unsafe /proc lookup, which is vulnerable to PID reuse attacks.

Detection Guidance

Check if your system uses zbus_polkit versions before 5.1.0 with: zbus_polkit --version. Inspect running processes for polkit-related services and verify if they handle UID inputs correctly. Monitor logs for unexpected authorization decisions or PID reuse patterns.

Impact Analysis

An attacker could exploit this to bypass permission checks by reusing a PID of a previously authorized process. This allows unauthorized actions to be performed under the identity of the terminated process, potentially gaining elevated privileges.

Mitigation Strategies

Upgrade zbus_polkit to version 5.1.0 or later. Restart affected services to apply the fix. Review polkit policies for unauthorized access attempts. Monitor system logs for suspicious PID reuse or privilege escalation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78422. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart