CVE-2026-78422— zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID
Quick assessment
Affected
z-galaxy zbus_polkit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
z-galaxy zbus_polkit是z-galaxy组织开源的一个用于与 PolicyKit 进行交互的 Rust 语言代理库。 z-galaxy zbus_polkit 5.1.0之前版本存在安全漏洞，该漏洞源于Subject::new_for_owner()函数将unix-process polkit主题的uid条目编码为无符号32位整数，而接口要求有符号32位整数，导致polkit丢弃调用者提供的UID，并通过/proc查找PID所有者，存在检查时间与使用时间竞态，可能导致本地低权限攻击者利用
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| z-galaxy | zbus_polkit | < 5.1.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78422
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID
Source: CVE Program / CVE List V5
Vulnerability Description
Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i). Because of this type mismatch, polkit silently discards the caller-supplied UID and instead determines the subject's owner itself by looking up the PID in /proc, a lookup that is inherently subject to a time-of-check/time-of-use race.
Consequently, an application that passes a UID obtained from a trustworthy source — for example SO_PEERCRED Unix socket peer credentials — in order to defend against PID reuse receives no protection, and the supplied UID has no effect on the authorization decision. A local unprivileged attacker who can cause an authorized process to terminate and then win the race to have their own process assigned the same PID can be authorized under the identity of the terminated process, bypassing the polkit authorization check and performing actions the attacker is not entitled to.
This issue affects zbus_polkit before 5.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用不正确参数类型的函数调用
Source: CVE Program / CVE List V5
Vulnerability Title
z-galaxy zbus_polkit 竞争条件问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
z-galaxy zbus_polkit是z-galaxy组织开源的一个用于与 PolicyKit 进行交互的 Rust 语言代理库。 z-galaxy zbus_polkit 5.1.0之前版本存在安全漏洞，该漏洞源于Subject::new_for_owner()函数将unix-process polkit主题的uid条目编码为无符号32位整数，而接口要求有符号32位整数，导致polkit丢弃调用者提供的UID，并通过/proc查找PID所有者，存在检查时间与使用时间竞态，可能导致本地低权限攻击者利用
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| z-galaxy | zbus_polkit | 0 ~ 5.1.0 | - |
|
II. Public POCs for CVE-2026-78422
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78422
请登录查看更多情报信息。