The vulnerability lies in the zbus_polkit crate’s handling of user identifiers. The function that creates a polkit subject encodes the Unix UID as an unsigned 32‑bit integer while the PolicyKit specification requires a signed integer. This type mismatch (CWE‑686) causes the authorization daemon to discard the supplied UID and instead resolve the caller’s identity by looking up the process ID in /proc. The lookup is subject to a time‑of‑check/time‑of‑use race (CWE‑367), and based on the description, it is inferred that an attacker would need to force a privileged process to exit and then quickly spawn a new process that receives the same PID, enabling a local attacker to subvert the authorization.

Affected systems are those that ship or reference the z-galaxy zbus_polkit crate at versions below 5.1.0. Based on the description, it is inferred that services such as systemd, desktop environments, or any application that relies on PolicyKit for authorization and uses this crate are notable targets.

The vulnerability is limited to systems running a version of zbus_polkit older than 5.1.0 and requires the presence of the vulnerable library in a process that calls Subject::new_for_owner. The likely attack vector is local, needing an attacker to cause a privileged process to terminate and quickly spawn a new process with the same PID, as inferred from the race condition described. The CVSS score of 7.3 reflects the high potential impact if the conditions are met. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been widely exploited. Because the attack exploits a race condition that is technically challenging to orchestrate, the immediate likelihood of exploitation is moderate, as inferred from the description. Once the vulnerability is discovered by attackers, the impact is significant, as the bypass grants unauthorized local privilege escalation. Administrators should treat it as a high‑risk local privilege escalation and apply the patch promptly.