CVE-2026-78422: CWE-686 Function call with incorrect argument type in z-galaxy zbus_polkit
Description
Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i). Because of this type mismatch, polkit silently discards the caller-supplied UID and instead determines the subject's owner itself by looking up the PID in /proc, a lookup that is inherently subject to a time-of-check/time-of-use race. Consequently, an application that passes a UID obtained from a trustworthy source — for example SO_PEERCRED Unix socket peer credentials — in order to defend against PID reuse receives no protection, and the supplied UID has no effect on the authorization decision. A local unprivileged attacker who can cause an authorized process to terminate and then win the race to have their own process assigned the same PID can be authorized under the identity of the terminated process, bypassing the polkit authorization check and performing actions the attacker is not entitled to. This issue affects zbus_polkit before 5.1.0.
CVSS v4.0
Score 7.3high
Affected software
z-galaxy
zbus_polkit
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from Subject::new_for_owner() encoding the UID as an unsigned 32-bit integer (D-Bus type u) while the PolicyKit1 interface expects a signed 32-bit integer (D-Bus type i). Due to this mismatch, polkit discards the provided UID and looks up the PID owner via /proc, which is susceptible to a time-of-check/time-of-use race condition. A local unprivileged attacker can exploit this by terminating an authorized process and quickly spawning a process with the same PID, thereby bypassing polkit authorization and performing unauthorized actions. This affects zbus_polkit versions prior to 5.1.0.
Potential Impact
The vulnerability allows a local unprivileged attacker to bypass polkit authorization checks by exploiting a race condition in PID reuse, potentially performing actions they are not entitled to. This undermines the security model of polkit authorization and can lead to privilege escalation on affected systems.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running untrusted local processes that could exploit PID reuse races in environments using affected versions of zbus_polkit. Monitor vendor channels for updates regarding an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- suse
- Date Reserved
- 2026-08-24T15:33:13.664Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9591ceacd9273b49360694
Added to database: 08/31/2026, 14:38:06 UTC
Last enriched: 09/07/2026, 14:52:59 UTC
Last updated: 10/13/2026, 18:48:23 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.