A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic...
Fix status by distribution
Records published by each distribution for this CVE. Fixed versions differ by release; check each link.
- BellSoft Alpaquita BELL-CVE-2026-85498 polkit Fix available
- Debian DEBIAN-CVE-2026-85498 policykit-1 Fix available
- Ubuntu UBUNTU-CVE-2026-85498 policykit-1 Fix available
Original description The description as published by the source.
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web secalert@redhat.com
- web secalert@redhat.com
- web secalert@redhat.com
- web nvd.nist.gov
- web github.com