CVE-2026-85498
Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).
- Record
CVE-2026-85498- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-06
EUVDEUVD-2026-112679
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).
- Record
EUVD-2026-112679- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-cvc4-pw4g-cgpc
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic...
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).
- Record
GHSA-cvc4-pw4g-cgpc- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).
- Record
CVE-2026-85498- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-06
OSVBELL-CVE-2026-85498
- Record
BELL-CVE-2026-85498- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-85498
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).
- Record
DEBIAN-CVE-2026-85498- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-07
Show 10 moreShow less
OSVOESA-2026-4000
polkit security update
polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.
Security Fix(es):
A vulnerability, which was classified as very critical, was found in Polkit. The issue is a stack-based buffer overflow in the read_cookie function, which may impact confidentiality, integrity, and availability.(CVE-2026-85498)
- Record
OESA-2026-4000- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2026-4001
polkit security update
polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.
Security Fix(es):
A vulnerability, which was classified as very critical, was found in Polkit. The issue is a stack-based buffer overflow in the read_cookie function, which may impact confidentiality, integrity, and availability.(CVE-2026-85498)
- Record
OESA-2026-4001- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2026-4002
polkit security update
polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.
Security Fix(es):
A vulnerability, which was classified as very critical, was found in Polkit. The issue is a stack-based buffer overflow in the read_cookie function, which may impact confidentiality, integrity, and availability.(CVE-2026-85498)
- Record
OESA-2026-4002- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2026-4003
polkit security update
polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.
Security Fix(es):
A vulnerability, which was classified as very critical, was found in Polkit. The issue is a stack-based buffer overflow in the read_cookie function, which may impact confidentiality, integrity, and availability.(CVE-2026-85498)
- Record
OESA-2026-4003- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2026-4050
polkit security update
polkit is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.
Security Fix(es):
A vulnerability, which was classified as very critical, was found in Polkit. The issue is a stack-based buffer overflow in the read_cookie function, which may impact confidentiality, integrity, and availability.(CVE-2026-85498)
- Record
OESA-2026-4050- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVRHSA-2026:66287
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:66287- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-85498
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).
- Record
UBUNTU-CVE-2026-85498- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-05
OSVMGASA-2026-0485 No score
Updated polkit package fixes a security vulnerability
Regression in CVE-2026-4897 fix (polkit read_cookie()) - stack buffer underflow. (CVE-2026-85498)
- Record
MGASA-2026-0485- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12203-1 No score
libpolkit-agent-1-0-128-1.1 on GA media
These are all security issues fixed in the libpolkit-agent-1-0-128-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12203-1- Updated
- 2026-11-02
OSVUSN-8762-1 No score
policykit-1 vulnerability
It was discovered that polkit incorrectly handled cookie input. A local attacker could possibly use this issue to cause polkit to crash, resulting in a denial of service, or execute arbitrary code.
- Record
USN-8762-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
polkitAlpaquita:23 |
122-r1 up to 122-r2 | 122-r2 |
polkitAlpaquita:25 |
126-r0 up to 126-r1 | 126-r1 |
polkitAlpaquita:stream |
122-r5 up to 128-r0 | 128-r0 |
policykit-1Debian:14 |
before 128-1, plus listed versions 126-2127-1127-2127-3 |
128-1 |
polkitMageia:10 |
before 127-3.1.mga10 | 127-3.1.mga10 |
polkitopenEuler:20.03-LTS-SP4 |
before 0.116-13.oe2003sp4 | 0.116-13.oe2003sp4 |
polkitopenEuler:22.03-LTS-SP4 |
before 0.120-13.oe2203sp4 | 0.120-13.oe2203sp4 |
polkitopenEuler:24.03-LTS-SP1 |
before 123-5.oe2403sp1 | 123-5.oe2403sp1 |
polkitopenEuler:24.03-LTS-SP3 |
before 123-5.oe2403sp3 | 123-5.oe2403sp3 |
polkitopenEuler:24.03-LTS-SP4 |
before 123-5.oe2403sp4 | 123-5.oe2403sp4 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
polkitRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:127-5.1.hum1 | 0:127-5.1.hum1 |
polkit-develRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:127-5.1.hum1 | 0:127-5.1.hum1 |
polkit-docsRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:127-5.1.hum1 | 0:127-5.1.hum1 |
polkit-libsRed Hat:hummingbird:1 From an advisory covering 2 CVEs |
before 0:127-5.1.hum1 | 0:127-5.1.hum1 |
policykit-1Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.105-3ubuntu30.105-4ubuntu10.105-4ubuntu20.105-4ubuntu2.14.04.10.105-4ubuntu3.14.04.1 Show 4 moreShow less0.105-4ubuntu3.14.04.20.105-4ubuntu3.14.04.50.105-4ubuntu3.14.04.60.105-4ubuntu3.14.04.6+esm1 |
None known |
policykit-1Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.105-11ubuntu20.105-130.105-13ubuntu10.105-140.105-14.1 Show 4 moreShow less0.105-14.1ubuntu0.10.105-14.1ubuntu0.40.105-14.1ubuntu0.50.105-14.1ubuntu0.5+esm1 |
None known |
policykit-1Ubuntu:18.04:LTS |
All versions, plus listed versions 0.105-180.105-200.105-20ubuntu0.18.04.10.105-20ubuntu0.18.04.40.105-20ubuntu0.18.04.50.105-20ubuntu0.18.04.6 |
None known |
policykit-1Ubuntu:20.04:LTS |
All versions, plus listed versions 0.105-26ubuntu10.105-26ubuntu1.10.105-26ubuntu1.20.105-26ubuntu1.3 |
None known |
policykit-1Ubuntu:22.04:LTS |
before 0.105-33ubuntu0.2, plus listed versions 0.105-310.105-31ubuntu10.105-31.10.105-320.105-330.105-33ubuntu0.1 |
0.105-33ubuntu0.2 |
policykit-1Ubuntu:24.04:LTS |
before 124-2ubuntu1.24.04.4, plus listed versions 123-1123-3124-1124-1ubuntu1124-2ubuntu1124-2ubuntu1.24.04.2124-2ubuntu1.24.04.3 |
124-2ubuntu1.24.04.4 |
policykit-1Ubuntu:26.04:LTS |
before 127-2ubuntu1.1, plus listed versions 126-2127-1127-2127-2ubuntu1 |
127-2ubuntu1.1 |
polkitopenSUSE:Tumbleweed |
before 128-1.1 | 128-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, EUVD, NVD, OSV | |
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-85498 is a low vulnerability (CVSS 3.5) in Red Hat Enterprise Linux 10, published September 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. Fixed in polkit 122-r2.
References
access.redhat.com/errata/RHSA-2026:66287
bugzilla.redhat.com/show_bug.cgi?id=2528347
nvd.nist.gov/vuln/detail/CVE-2026-85498
github.com/advisories/GHSA-cvc4-pw4g-cgpc
docs.bell-sw.com/security/cves/CVE-2026-85498
Show 19 moreShow less
security-tracker.debian.org/tracker/CVE-2026-85498
advisories.mageia.org/MGASA-2026-0485.html
bugs.mageia.org/show_bug.cgi?id=36322
ubuntu.com/security/notices/USN-8762-1
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4000
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66287.json
cve.org/CVERecord?id=CVE-2026-4897
suse.com/security/cve/CVE-2026-85498