CVE-2026-78422 in zbus_polkit
Summary
by MITRE • 08/31/2026
Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i). Because of this type mismatch, polkit silently discards the caller-supplied UID and instead determines the subject's owner itself by looking up the PID in /proc, a lookup that is inherently subject to a time-of-check/time-of-use race.
Consequently, an application that passes a UID obtained from a trustworthy source — for example SO_PEERCRED Unix socket peer credentials — in order to defend against PID reuse receives no protection, and the supplied UID has no effect on the authorization decision. A local unprivileged attacker who can cause an authorized process to terminate and then win the race to have their own process assigned the same PID can be authorized under the identity of the terminated process, bypassing the polkit authorization check and performing actions the attacker is not entitled to.
This issue affects zbus_polkit before 5.1.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability in question resides within the new_for_owner function of the zbus_polkit crate, which serves as a critical component for interfacing with PolicyKit on Linux systems via D-Bus. The core technical flaw is a type mismatch between the implementation and the specification. Specifically, the function encodes the user identifier (UID) entry of a Unix process PolKit subject using an unsigned 32-bit integer, corresponding to the D-Bus type u. However, the org.freedesktop.PolicyKit1.Authority interface explicitly mandates that this field be encoded as a signed 32-bit integer, or D-Bus type i. This discrepancy is not merely cosmetic; it fundamentally alters how the PolKit daemon interprets the incoming data structure when validating authorization requests from client applications.
When a request containing an unsigned UID is received by the PolKit daemon against this interface definition expecting a signed integer, the mismatch triggers undefined behavior or silent failure in parsing logic depending on the specific D-Bus library implementation details. In the observed scenario involving zbus_polkit versions prior to 5.1.0, the consequence of this type error is that the PolKit system silently discards the caller-supplied UID entirely. Instead of relying on the explicit identity provided by the application, which might have been derived from secure sources such as SO_PEERCRED Unix socket peer credentials, the daemon falls back to an alternative method for determining the subject's owner. It performs a lookup in the /proc filesystem using the process identifier (PID) associated with the request.
This fallback mechanism introduces a severe time-of-check/time-of-use race condition vulnerability. The act of looking up the PID in /proc is not atomic relative to the authorization decision. If an authorized, privileged process terminates and its PID becomes available for reuse by another process on the system, there exists a narrow window where a malicious actor can spawn their own unprivileged process that gets assigned this recycled PID. Because PolKit relies on the current owner of that PID rather than the originally intended UID, it will attribute the actions to the user owning the newly spawned process if the lookup occurs after the switch, or potentially misattribute based on transient states during the race window.
The operational impact is significant for local security posture. An unprivileged attacker who can influence process scheduling and termination events can exploit this race condition to bypass PolKit authorization checks entirely. By causing a privileged process to terminate and then rapidly creating their own process with the same PID, the attacker forces PolKit to evaluate permissions based on the wrong identity context or an unstable state. This allows the attacker to execute actions that require higher privileges than they possess, effectively escalating their access rights without needing to exploit traditional privilege escalation vectors like buffer overflows or kernel exploits. The protection offered by passing explicit UIDs from trustworthy sources is completely nullified because those values are ignored due to the encoding error.
Mitigation strategies must address both the immediate code defect and the underlying architectural reliance on PID-based lookups which are inherently vulnerable to reuse attacks in multi-user environments. For users of the zbus_polkit crate, upgrading to version 5.1.0 or later is the primary remediation step, as this release corrects the D-Bus type encoding to align with the signed integer specification required by PolicyKit. Beyond software updates, system administrators should consider implementing stricter PID reuse protections where possible, such as enabling kernel features that make PID allocation more random and less predictable, although these do not fully eliminate race conditions in all scenarios. Application developers integrating PolKit should also ensure they are using libraries that strictly adhere to the D-Bus specifications for PolicyKit interfaces to prevent silent data corruption or misinterpretation of security-critical fields like user identifiers.
This vulnerability maps directly to CWE-20, Improper Input Validation, as the system fails to correctly validate and handle input types according to specification. Furthermore, it aligns with ATT&CK technique T1653, Misuse of Configuration Files, in a broader sense where configuration or interface definitions are misinterpreted leading to security bypasses, though more accurately it represents an improper handling of identity attributes that facilitates privilege escalation. The failure to correctly encode the UID leads to a breakdown in the principle of least privilege by allowing unauthorized processes to assume the identity of authorized ones through temporal manipulation rather than cryptographic or permission-based enforcement.