CVE-2026-85498: Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

Severity: low (CVSS 3.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-29 · updated 2026-10-30
Weakness: CWE-125

Description

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).

Affected products

Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 6: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions
Red Hat Hardened Images: all versions — fixed in 127-5.1.hum1
Red Hat OpenShift Container Platform 5: all versions

How to fix

Upgrade to a fixed version: Red Hat Hardened Images 127-5.1.hum1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-85498 or the next vulnerability affects your stack