CVE-2026-78422

CVE-2026-78422 is a flaw in the zbus_polkit Rust crate's Subject::new_for_owner() function, which encodes the caller-supplied UID with the wrong D-Bus type (unsigned integer instead of the signed integer required by the org.freedesktop.PolicyKit1.Authority interface), so polkit silently discards the supplied UID and instead re-derives the process owner itself by looking the PID up in /proc. That /proc lookup is inherently a time-of-check/time-of-use race, meaning the UID that applications pass in — typically taken from a trusted source such as SO_PEERCRED socket peer credentials precisely to defend against PID reuse — has no effect on the authorization decision. An unprivileged local attacker who can cause an already-authorized process to terminate and then win the race to have their own process assigned the recycled PID is treated by polkit as that authorized subject, bypassing the authorization check and performing actions they are not entitled to. Only Linux applications built with zbus_polkit versions before 5.1.0 that rely on this API for authorization decisions are affected, along with their users. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS assigns a 0.1% 30-day exploitation probability; the flaw is rated 7.3 (high) in CVSS 4.0 with high attack complexity due to the required race.

What to do: Upgrade zbus_polkit to 5.1.0 or later, which encodes the UID with the correct signed D-Bus type so polkit honors the caller-supplied identity. If you maintain a Rust application using Subject::new_for_owner(), audit whether authorization decisions depend on that call and, until patched, consider re-validating subjects after authorization or using an alternative authorization path that is not vulnerable to PID reuse. Watch for updated packages from your distribution (SUSE is the assigning CNA) and rebuild dependent applications against the fixed crate.