RLSA-2026:97463: Moderate: polkit security update
The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privileged processes to communicate with privileged ones.
Security Fix(es):
polkit: Polkit: Denial of Service via unbounded input processing through standard input (CVE-2026-4897)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/polkitto a version that resolves this vulnerability.Fixed in 0:0.117-16.el9 - Upgrade
Upgrade
rocky-linux/polkit-debuginfoto a version that resolves this vulnerability.Fixed in 0:0.117-16.el9 - Upgrade
Upgrade
rocky-linux/polkit-debugsourceto a version that resolves this vulnerability.Fixed in 0:0.117-16.el9 - Upgrade
Upgrade
rocky-linux/polkit-develto a version that resolves this vulnerability.Fixed in 0:0.117-16.el9 - Upgrade
Upgrade
rocky-linux/polkit-libsto a version that resolves this vulnerability.Fixed in 0:0.117-16.el9 - Upgrade
Upgrade
rocky-linux/polkit-libs-debuginfoto a version that resolves this vulnerability.Fixed in 0:0.117-16.el9 - Upgrade
Upgrade
rocky-linux/polkit-docsto a version that resolves this vulnerability.Fixed in 0:0.117-16.el9
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation requires local access and low privileges. No user interaction is required.
What is the expected security impact?
The issue is rated as affecting availability only, with no indicated confidentiality or integrity impact. It can cause a denial of service through unbounded processing of standard input.
Which installed packages should be reviewed?
Review Rocky Linux systems with polkit installed, including polkit-libs and related polkit development, documentation, debug, and debuginfo packages listed in the advisory.