Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-78422— zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID

Quick assessment

Affected
z-galaxy zbus_polkit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

软件包中的 将 Unix 进程 polkit 主体的 uid 字段编码为无符号 32 位整数（D-Bus 类型 ），而 接口规范要求的是有符号 32 位整数（D-Bus 类型 ）。由于存在这种类型不匹配，polkit 会静默丢弃调用方提供的 UID，并转而通过查询 中的 PID 来自主确定主体所有者，而该查询过程天然存在检查时/使用时（TOCTOU，Time-of-Check/Time-of-Use）竞争条件。 因此，即便应用程序从一个可靠来源（例如通过 Unix 套接字的 对端凭据）获取并传入一个 UID，试图防

CVSS 7.3 · High

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 1

VendorProduct Version RangeStatus
z-galaxy zbus_polkit < 5.1.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-78422

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID
Source: CVE Program / CVE List V5
Vulnerability Description
Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i). Because of this type mismatch, polkit silently discards the caller-supplied UID and instead determines the subject's owner itself by looking up the PID in /proc, a lookup that is inherently subject to a time-of-check/time-of-use race. Consequently, an application that passes a UID obtained from a trustworthy source — for example SO_PEERCRED Unix socket peer credentials — in order to defend against PID reuse receives no protection, and the supplied UID has no effect on the authorization decision. A local unprivileged attacker who can cause an authorized process to terminate and then win the race to have their own process assigned the same PID can be authorized under the identity of the terminated process, bypassing the polkit authorization check and performing actions the attacker is not entitled to. This issue affects zbus_polkit before 5.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用不正确参数类型的函数调用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
z-galaxy zbus_polkit 0 ~ 5.1.0 -

II. Public POCs for CVE-2026-78422

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-78422

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-78422 (1)

Other References for CVE-2026-78422 (1)

IV. Related Vulnerabilities

Same weakness: CWE-686

V. Comments for CVE-2026-78422

No comments yet

Leave a comment