CVE-2026-78422: zbus_polkit Privilege Escalation Vulnerability

CVE-2026-78422 Overview

CVE-2026-78422 affects the zbus_polkit Rust crate before version 5.1.0. The Subject::new_for_owner() function encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u). However, the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i). This type mismatch causes polkit to silently discard the caller-supplied UID. Polkit then determines the subject's owner by looking up the PID in /proc, introducing a time-of-check/time-of-use (TOCTOU) race condition [CWE-367].

Critical Impact
A local unprivileged attacker can win a PID reuse race to be authorized under the identity of a terminated privileged process, bypassing polkit authorization checks.

Affected Products

zbus_polkit crate versions before 5.1.0
Applications relying on Subject::new_for_owner() for polkit authorization
Linux systems using zbus_polkit-based D-Bus services with polkit integration

Discovery Timeline

2026-08-31 - CVE-2026-78422 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-78422

Vulnerability Analysis

The zbus_polkit crate provides Rust bindings to interact with polkit, the Linux privilege authorization framework. When constructing a unix-process subject via Subject::new_for_owner(), the crate serializes the UID as an unsigned 32-bit integer over D-Bus. The polkit org.freedesktop.PolicyKit1.Authority interface expects a signed 32-bit integer for the same field.

Because of this D-Bus type signature mismatch, polkit cannot deserialize the caller-supplied UID from the subject dictionary. Rather than rejecting the request, polkit silently ignores the missing field. It then falls back to resolving the process owner itself by reading /proc/<pid>/status. This fallback is inherently vulnerable to PID reuse between the time the caller obtained the PID and the time polkit performs the lookup.

Root Cause

The root cause is an incorrect D-Bus type annotation in the zbus_polkit crate. Callers that supply a UID from a trustworthy source such as SO_PEERCRED Unix socket peer credentials expect polkit to honor that UID as an anti-PID-reuse defense. Instead, the supplied UID has no effect on the authorization decision because polkit never receives it in a form it can parse.

Attack Vector

A local unprivileged attacker identifies an authorized process communicating over a D-Bus service backed by zbus_polkit. The attacker forces the authorized process to terminate, for example by exploiting a crash or waiting for normal exit. The attacker then rapidly spawns new processes to win the race for PID assignment, aiming to receive the same PID as the terminated privileged process.

When the D-Bus service subsequently invokes polkit to authorize an action, polkit reads /proc/<pid> and observes the attacker's process under the reused PID. Polkit resolves the owner as the attacker's UID but authorizes the action under the identity previously associated with that PID in the service's session tracking. This allows the attacker to perform privileged actions they should not be entitled to. See the SUSE Bug Report #1277659 and GitHub Pull Request for zbus_polkit for technical details.

Detection Methods for CVE-2026-78422

Indicators of Compromise

Rapid process creation loops from unprivileged users targeting specific PID values shortly after a privileged D-Bus client exits.
Polkit authorization decisions logged for actions inconsistent with the invoking process's actual credentials.
Unusual fork()/execve() bursts in audit logs correlated with D-Bus method calls to services using polkit.

Detection Strategies

Audit dependency manifests (Cargo.toml, Cargo.lock) across Rust projects for zbus_polkit versions below 5.1.0.
Enable Linux audit rules on polkit-agent-helper-1 executions and correlate with /proc/<pid> accesses.
Monitor D-Bus method calls to org.freedesktop.PolicyKit1.Authority.CheckAuthorization for subjects lacking valid UID metadata.

Monitoring Recommendations

Ingest journald polkit events into a centralized logging pipeline and alert on authorization grants preceded by rapid process churn under the same PID.
Track short-lived process creation patterns targeting specific PID ranges as a potential race-window exploitation signal.
Baseline normal polkit authorization frequency per service and alert on statistically significant spikes.

How to Mitigate CVE-2026-78422

Immediate Actions Required

Upgrade zbus_polkit to version 5.1.0 or later across all Rust projects and rebuild affected binaries.
Inventory production systems for D-Bus services built against vulnerable zbus_polkit releases and prioritize patching those exposing privileged actions.
Review polkit policy rules (/etc/polkit-1/rules.d/) to reduce the scope of actions available to unprivileged local users where feasible.

Patch Information

The fix is included in zbus_polkit 5.1.0, which corrects the D-Bus type signature for the uid field from u to i. Details are available in the GitHub Pull Request for zbus_polkit.

Workarounds

Where upgrading is not immediately possible, restrict local access to affected D-Bus services through polkit policy hardening.
Constrain the set of local users permitted to invoke privileged D-Bus actions by tightening group membership and PAM configuration.
Consider disabling optional D-Bus services that depend on vulnerable zbus_polkit builds until patched.

bash

# Update Cargo.toml to enforce the fixed version
# [dependencies]
# zbus_polkit = ">=5.1.0"
cargo update -p zbus_polkit
cargo tree -i zbus_polkit  # Verify no vulnerable versions remain