Summary
It was discovered that polkit incorrectly handled cookie input.
A local
attacker could possibly use this issue to cause polkit
to crash, resulting
in a denial of service, or execute arbitrary code.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | policykit-1 | 0.105-33ubuntu0.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | policykit-1 | 124-2ubuntu1.24.04.4 |
| Ubuntu · 26.04 LTS 26.04:LTS | policykit-1 | 127-2ubuntu1.1 |
Vulnerabilities 1
-
Low 3.5
Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable…
References
-
report
https://ubuntu.com/security/CVE-2026-85498