zbus_polkit EUVD-2026-68593

The attacker must hold a local user account capable of spawning processes on the affected Linux system (PR:L per CVSS 4.0). The target application must be built with zbus_polkit prior to 5.1.0 and must invoke Subject::new_for_owner() to construct polkit subjects - only Rust applications using this specific crate in this manner are in scope. The attacker must additionally be able to cause a polkit-authorized process to terminate (through natural exit, an induced error condition, or any signal the attacker can deliver) and then win the Linux kernel's PID reassignment race by rapidly forking processes. This timing dependency (AT:P in CVSS 4.0) is the primary limiting factor: the race window may vary with system load but does not require any non-default kernel configuration - standard Linux PID recycling behavior is sufficient. Exploitation is strictly local; no network-accessible path exists (AV:L).

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) accurately represents the threat profile: local access and low privileges are required, with a specific timing condition (AT:P - winning a PID reuse race) being the primary barrier to exploitation. The race is probabilistic but well-understood from prior polkit TOCTOU disclosures, and the fix being a one-line cast underscores that the vulnerability is structurally simple even if exploitation timing is constrained. EPSS data is absent from the input and this CVE does not appear in CISA KEV, so widespread or automated exploitation is not confirmed - the SSVC exploitation status would be rated 'none' at time of analysis. The high VC/VI/VA impact ratings reflect that a successful race grants full authorization as the targeted process, potentially including root-equivalent actions depending on what that process was authorized to perform. The trivial fix and the fact that the attack requires only a local foothold and ordinary timing skill argue strongly for treating this as an urgent patch priority.

A local unprivileged attacker monitors the PID of a polkit-authorized process and, after it exits, rapidly spawns processes to acquire the same PID from the kernel's recycling pool. Because zbus_polkit encodes the UID with the wrong D-Bus type, polkit discards it and resolves identity from /proc - seeing the attacker's process now occupying the formerly privileged PID slot and granting the authorization originally intended for the terminated process. No public exploit code has been identified at time of analysis, but the TOCTOU technique is well-documented from prior Linux polkit research.