Which versions of PortProtonQt are affected by CVE-2026-59676?

PortProtonQt versions 0.1.12 through 1.3.0 contain a local privilege escalation vulnerability that enables any user with local system access to reconfigure network settings and control storage…. A patch is available.

How to fix or mitigate CVE-2026-59676?

Within 24 hours, identify all systems running PortProtonQt 0.1.12 through 1.3.0 and evaluate removing or air-gapping affected systems from production networks pending patch availability. Within 7 days, implement interim controls including disabling the vulnerable Polkit rule (ru.linux_gaming.PortProtonQt.rules), restricting local system access to trusted users only, and deploying file integrity monitoring on NetworkManager configuration files. Within 30 days, establish escalation contact with the PortProtonQt development team to track patch timeline, evaluate alternative solutions that do not depend on vulnerable Polkit authorization patterns, and maintain a comprehensive inventory of affected systems to support remediation tracking.

PortProtonQt CVE-2026-59676

Q: What is the CVSS score of CVE-2026-59676?

CVE-2026-59676 has a CVSS 4.0 base score of 5.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-47888 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-07-22

GHSA-j6qh-f45v-j454

Information Disclosure Red Hat Suse

5.8

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.8 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Local-only attack (AV:L), trivially spoofable with no complexity (AC:L), any unprivileged local user (PR:L), no confidentiality impact but full integrity and availability impact on network and filesystem state.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 23, 2026 - 07:22 NVD

5.8 (MEDIUM)

Patch released

Jul 23, 2026 - 04:01 NVD

Source Code Evidence Fetched

Jul 22, 2026 - 16:20 vuln.today

Analysis Generated

Jul 22, 2026 - 16:20 vuln.today

CVE Published

Jul 22, 2026 - 16:00 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Polkit privilege escalation in PortProtonQt 0.1.12 through 1.3.0 allows any local unprivileged user to modify system NetworkManager connections and mount or unmount arbitrary block devices without authorization. The vulnerable Polkit rule (ru.linux_gaming.PortProtonQt.rules) identifies trusted callers by inspecting process command lines via 'ps', a method trivially defeated by command-line spoofing or PID recycling races. A shell script reproducer confirmed by SUSE researchers achieves exploitation reliably and consistently. No public exploit is independently published but a working reproducer exists; no CISA KEV listing at time of analysis.

Technical ContextAI

PortProtonQt installs a Polkit JavaScript rules file (ru.linux_gaming.PortProtonQt.rules) to authorize the companion 'ppqtos' binary to perform privileged actions without a password prompt. The rule calls polkit.spawn(['ps', ...]) to read the command-line arguments of the requesting process and its parent PID, then grants polkit.Result.YES to four sensitive actions - org.freedesktop.NetworkManager.settings.modify.system, org.freedesktop.udisks2.filesystem-mount-system, org.freedesktop.udisks2.filesystem-mount-other-seat, and org.freedesktop.udisks2.filesystem-unmount-others - if the string 'ppqtos' appears in either command line. This design is insecure on two axes: (1) any process can include 'ppqtos' as an argument or in its argv[0] with no kernel enforcement, trivially spoofing the check; (2) the subject.pid inspected by the rule can be recycled between the moment a Polkit request is submitted and the moment the rule evaluates it (classic TOCTOU race). The underlying root cause maps to CWE-290 (Authentication Bypass by Spoofing) combined with CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization). The fix in v1.3.1 (commit f0ab40a2d) replaces command-line inspection with subject.local, subject.active, and subject.isInGroup('portprotonqt') - Polkit-native, kernel-enforced attributes not spoofable from userspace.

RemediationAI

Upgrade to PortProtonQt version 1.3.1, released 2026-07-18. The patch is confirmed at https://github.com/Boria138/PortProtonQt/commit/f0ab40a2dab36ce91bc7e1b13d8d4ea220e5107c and replaces the insecure command-line inspection with a group membership check (portprotonqt group) combined with subject.local and subject.active checks. After upgrading, only users explicitly added to the portprotonqt group retain the elevated Polkit permissions, and only during active local sessions. As a compensating control prior to patching, administrators can remove or zero-out the file /usr/share/polkit-1/rules.d/ru.linux_gaming.PortProtonQt.rules - the upstream developer confirmed the Polkit rules file is not required for PortProtonQt's core functionality. Removing this file eliminates the attack surface with no functional impact on game launching. Alternatively, tightening filesystem permissions on the rules file to prevent Polkit from reading it achieves the same effect. The openSUSE review bug is tracked at https://bugzilla.suse.com/show_bug.cgi?id=1270218.