CVE-2026-78422: zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID
Subject::newforowner() in the zbuspolkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i). Because of this type mismatch, polkit silently discards the caller-supplied UID and instead determines the subject's owner itself by looking up the PID in /proc, a lookup that is inherently subject to a time-of-check/time-of-use race.
Consequently, an application that passes a UID obtained from a trustworthy source — for example SOPEERCRED Unix socket peer credentials — in order to defend against PID reuse receives no protection, and the supplied UID has no effect on the authorization decision. A local unprivileged attacker who can cause an authorized process to terminate and then win the race to have their own process assigned the same PID can be authorized under the identity of the terminated process, bypassing the polkit authorization check and performing actions the attacker is not entitled to.
This issue affects zbuspolkit before 5.1.0.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Applications using zbus_polkit before 5.1.0 are affected when they authorize unix-process polkit subjects and rely on a caller-supplied UID, such as one obtained through SO_PEERCRED, to protect against PID reuse.
What must an attacker be able to do to exploit it?
The attacker must be a local unprivileged user able to cause an authorized process to terminate and win the race to obtain the terminated process's PID for their own process. The attacker can then be authorized as the identity associated with the terminated process.
Does passing a trusted UID to Subject::new_for_owner() mitigate PID reuse?
No. In affected versions, the UID is encoded with the wrong D-Bus type and silently discarded by polkit, which instead looks up the PID owner through /proc.
How can I determine whether a deployment is affected?
Check whether the application uses zbus_polkit before 5.1.0 and calls Subject::new_for_owner() for unix-process authorization subjects. Such usage is affected because the supplied UID does not influence polkit's authorization decision.