Local Privilege Escalation Vulnerability in zbus_polkit by Z-Galaxy

CVE-2026-78422

What is CVE-2026-78422?

A vulnerability in the zbus_polkit crate allows local unprivileged attackers to escalate privileges by bypassing authorization checks. This occurs due to a type mismatch where the UID is treated as an unsigned integer instead of a signed integer, leading to potential race conditions during the authorization process. By exploiting this flaw, attackers can assume the identity of other processes that have terminated and perform actions that should otherwise be restricted, compromising system integrity.

References