CVE-2026-25710: plasmaloginauthhelper Privilege Escalation

CVE-2026-25710 Overview

CVE-2026-25710 affects the Plasma Login Manager, where an upstream change introduced a privileged D-Bus helper named plasmaloginauthhelper. The helper exposes multiple security weaknesses. A compromised plasmalogin service account can invoke the helper to call chown() on arbitrary files across the system. This local privilege escalation primitive allows an attacker who controls the plasmalogin account to change ownership of any file, leading to full root compromise. The flaw is tracked under CWE-250: Execution with Unnecessary Privileges.

Critical Impact
A compromised plasmalogin service account can change ownership of arbitrary files through the privileged plasmaloginauthhelper D-Bus interface, enabling local privilege escalation to root.

Affected Products

Plasma Login Manager (upstream plasmalogin) with the new plasmaloginauthhelper D-Bus helper
openSUSE distributions shipping the affected plasma-login-manager package
SUSE Linux distributions tracking the upstream component

Discovery Timeline

2026-05-13 - CVE-2026-25710 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-25710

Vulnerability Analysis

The Plasma Login Manager upstream introduced plasmaloginauthhelper, a D-Bus service running with elevated privileges. The helper accepts requests from the unprivileged plasmalogin service account and performs sensitive filesystem operations on its behalf. Because the helper does not adequately restrict the target paths supplied by callers, a caller controlling the plasmalogin account can request ownership changes on arbitrary files in the system. The vulnerability falls under CWE-250: Execution with Unnecessary Privileges, since the helper performs privileged work without applying the principle of least privilege to its inputs.

Root Cause

The root cause is missing path validation and insufficient privilege separation in the plasmaloginauthhelper D-Bus method handling file ownership changes. The helper trusts the calling plasmalogin account and forwards caller-supplied paths to chown() without restricting them to expected directories such as the session manager's runtime state or per-user configuration paths. Any code execution as plasmalogin therefore inherits the helper's privileged capabilities through D-Bus.

Attack Vector

Exploitation requires local access and existing control of the plasmalogin service account, for example through a separate vulnerability in the login manager or a misconfiguration that exposes the account. An attacker invokes the privileged helper over D-Bus and supplies a path to a sensitive file such as /etc/shadow, /etc/sudoers, or a root-owned binary. The helper executes chown() against that path, transferring ownership to an attacker-controlled identity. The attacker then modifies the file and escalates to root. User interaction may be required depending on the session flow.

No public proof-of-concept exploit code is currently available. Refer to the openSUSE Security Update and the OpenWall OSS-Security Discussion for the upstream technical write-up.

Detection Methods for CVE-2026-25710

Indicators of Compromise

Unexpected ownership changes on system files such as /etc/shadow, /etc/sudoers, /etc/passwd, or binaries under /usr/bin and /usr/sbin.
D-Bus method calls to plasmaloginauthhelper originating from the plasmalogin account that reference paths outside the expected session directories.
New or modified SUID binaries owned by the plasmalogin user following helper invocations.

Detection Strategies

Audit chown() system calls using the Linux audit subsystem and alert on operations performed by the plasmaloginauthhelper process against paths outside /var/lib/plasmalogin or /run/plasmalogin.
Monitor D-Bus traffic to the helper's bus name and log the method, caller, and arguments for review.
Correlate process ancestry where plasmaloginauthhelper is spawned by D-Bus activation in response to requests from the plasmalogin account.

Monitoring Recommendations

Enable auditd rules on chown, fchown, and lchown syscalls with filters for the plasmaloginauthhelper executable path.
Forward audit and D-Bus logs to a central SIEM and baseline normal helper activity to surface anomalies.
Track file integrity on /etc and critical binary directories to flag ownership drift in near real time.

How to Mitigate CVE-2026-25710

Immediate Actions Required

Apply the vendor patch for plasma-login-manager distributed through openSUSE and SUSE security channels as soon as it is available in your update repositories.
Restrict and audit any local accounts that can act as, or escalate to, the plasmalogin service account.
Verify the integrity and ownership of sensitive files such as /etc/shadow, /etc/sudoers, and SUID binaries on affected hosts.

Patch Information

Fixes are tracked in the SUSE Bugzilla entry for CVE-2026-25710 and announced in the openSUSE Security Update. Update the plasma-login-manager package to the fixed upstream version that hardens the plasmaloginauthhelper D-Bus interface and restricts target paths for ownership changes.

Workarounds

If patching is not immediately possible, disable or mask the plasmaloginauthhelper D-Bus service where the login manager is not required.
Tighten D-Bus policy files to deny method calls to the helper from all but the minimum required system accounts.
Switch affected systems to an alternative display or login manager until the fixed package is deployed.

bash

# Configuration example: verify package version and inspect helper status
rpm -q plasma-login-manager
systemctl status plasmaloginauthhelper.service
# Review D-Bus policy for the helper
cat /usr/share/dbus-1/system.d/org.kde.plasmalogin.AuthHelper.conf