CVE-2026-78422

Name of the Vulnerable Software and Affected Versions zbus polkit versions prior to 5.1.0

Description The Subject::new for owner() function in the zbus polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), while the org.freedesktop.PolicyKit1.Authority interface expects a signed 32-bit integer (D-Bus type i). This type mismatch causes polkit to discard the supplied uid and instead determine the subject's owner by looking up the PID in /proc. This process is susceptible to a time-of-check/time-of-use (TOCTOU) race, where a local unprivileged attacker can exploit PID reuse. If an attacker can cause an authorized process to terminate and obtain the same PID, they may be authorized under the identity of the terminated process, bypassing authorization checks.

Recommendations Update to version 5.1.0 or later.