Most recent entries from all

CVE-2026-4897 — Polkit: polkit: denial of service via unbounded input processing through standard input

Affected: Red Hat Enterprise Linux 10, Red Hat Hardened Images, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4

A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.

USN-8173-1 — policykit-1 vulnerabilities

Affected: Ubuntu:22.04:LTS: policykit-1, Ubuntu:24.04:LTS: policykit-1, Ubuntu:25.10: policykit-1

It was discovered that polkit incorrectly handled nested elements in XML policy files. If an administrator were tricked into installing a malicious policy file, a remote attacker could possibly use this issue to cause polkit to crash, resulting in a denial of service. (CVE-2025-7519)

Pavel Kohout discovered that the polkit polkit-agent-helper-1 utility incorrectly handled long input. A local attacker could possibly use this issue to cause polkit to crash, resulting in a denial of service. (CVE-2026-4897)