CVE-2026-85498: Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).
Other sources
Upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c of polkit contains a regression stack buffer overflow: an unbounded getline() call was replaced in readcookie() in /src/polkitagent/polkitagenthelperprivate.c, wherein fgets() copies bytes verbatim and does not stop at an embedded NUL byte. If the first byte read from stdin is 0x00, buf[0] == '\0' and strlen(buf) returns 0. The expression strlen(buf) - 1 then underflows (sizet)0 - 1 to SIZEMAX, and buf[SIZEMAX] is an out-of-bounds read. On a typical two's-complement 64-bit target the pointer arithmetic wraps modulo 2^64, so in practice this reads buf[-1] - one byte immediately before the stack buffer.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/policykit-1to a version that resolves this vulnerability.Fixed in 0.105-33ubuntu0.2 - Upgrade
Upgrade
ubuntu/policykit-1to a version that resolves this vulnerability.Fixed in 124-2ubuntu1.24.04.4 - Upgrade
Upgrade
ubuntu/policykit-1to a version that resolves this vulnerability.Fixed in 127-2ubuntu1.1 - Upgrade
Upgrade
debian/policykit-1to a version that resolves this vulnerability.Fixed in 128-1 - Upgrade
Upgrade
debian/policykit-1to a version that resolves this vulnerability.Fixed in 122-3Fixed in 126-2Fixed in 128-1