CVE-2026-4897: Polkit: polkit: denial of service via unbounded input processing through standard input

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-26 · updated 2026-09-10
Weakness: CWE-770

Description

A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.

Affected products

Freedesktop Polkit: all versions
Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0, 10.0
Red Hat OpenShift Container Platform 4.18: 4.0

References

https://access.redhat.com/errata/RHSA-2026:59997
https://access.redhat.com/errata/RHSA-2026:66287
https://access.redhat.com/security/cve/CVE-2026-4897
https://bugzilla.redhat.com/show_bug.cgi?id=2451739

Get alerted when CVE-2026-4897 or the next vulnerability affects your stack