The vulnerability in CVE-2026-7867 stems from a conceptual error in how udisks2's D-Bus interface handles the 'as-user' parameter. The daemon correctly verifies that the calling session has authorization to trigger mount operations via polkit, but then implicitly trusts the caller's assertion about which UID should execute that mount. This conflates two distinct authorization decisions: 'is this principal allowed to mount?' and 'under what identity should this mount run?' The second question should be answered by policy, not by client-supplied input.
The practical exploitation vector is namespace injection. When an attacker mounts a filesystem as UID 0 (or any privileged UID), they control that UID's view of the filesystem tree. Any subsequent privileged daemon, cron job, systemd service, or admin script that reads from that mount namespace encounters whatever files the attacker positioned there—or finds files missing that should exist. This is not traditional privilege escalation; it's namespace hijacking, operating below the layer where most audit tools monitor.
The 7.8 CVSS rating understates the risk in three ways. First, console session access is routine in shared workstations, CI runners, and virtualized environments—treating it as a high barrier is unrealistic. Second, the mount persists for the lifetime of the udisks2 daemon process, creating persistent positioning rather than a point-in-time escalation. Third, the blast radius cascades through every privileged process on the host that inherits the manipulated namespace.
Before patching, verify which udisks2 version you run and check whether your distribution has released an update. After patching, audit any automation that depends on udisks2's mount namespace output—the fix closes the injection vector but doesn't retroactively validate assumptions downstream processes may have made about mount trustworthiness. Review adjacent D-Bus methods in udisks2 for similar patterns where caller-supplied identity parameters may have been treated as non-security-critical input.