CVE-2026-4897
Unbounded Input DoS in polkit-agent-helper-1 Setuid Binary
Publication date: 2026-03-26
Last updated on: 2026-04-21
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | enterprise_linux | 7.0 |
| redhat | enterprise_linux | 6.0 |
| redhat | enterprise_linux | 8.0 |
| redhat | openshift_container_platform | 4.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux | 10.0 |
| freedesktop | polkit | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-4897 is a vulnerability in polkit's setuid helper binary called polkit-agent-helper-1. A local user can exploit this by providing a specially crafted, excessively long input through standard input (stdin). The helper reads this input using the getline() function without limiting the input length, which causes unbounded memory allocation.
Because the input length is not limited, the program keeps allocating more memory until the system runs out of memory (OOM) or an error occurs. This leads to a Denial of Service (DoS) condition, making the system unresponsive or unstable.
The vulnerability arises because a check to see if stdin is a terminal (using isatty()) happens too late, after the unbounded memory allocation has already occurred. Also, this check only blocks terminal input but not other input sources like pipes, which can be exploited by an attacker.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing a local attacker to cause a Denial of Service (DoS) on your system. By exploiting the unbounded input processing in the polkit-agent-helper-1 binary, an attacker can cause the system to run out of memory.
When the system runs out of memory, it can become unresponsive or crash, disrupting normal operations and potentially requiring a reboot or manual intervention to restore service.
Since the vulnerable binary runs with setuid root permissions, any local user can trigger this condition, making it a significant risk on multi-user systems.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a local user to cause a denial of service (DoS) by triggering unbounded memory allocation in the polkit setuid helper. While it impacts system availability, there is no information provided about any impact on confidentiality, integrity, or data exposure.
Common standards and regulations such as GDPR and HIPAA emphasize the protection of personal data confidentiality, integrity, and availability. A denial of service could affect availability, but since this vulnerability does not involve unauthorized data access or modification, its direct impact on compliance with these regulations is limited to potential availability concerns.
No explicit information is provided in the context or resources about compliance implications or mitigation steps related to regulatory standards.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the unbounded input condition on the vulnerable setuid binary `polkit-agent-helper-1`. A local user can test for the vulnerability by providing a very large input without a newline to the helper via stdin.
An example command to test the vulnerability is:
- python3 -c "print('A'*200000000, end='')" | /usr/lib/polkit-1/polkit-agent-helper-1 $(whoami)
If the system experiences an out-of-memory (OOM) condition or the helper crashes, it indicates the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting local user access to the vulnerable setuid binary `polkit-agent-helper-1` to prevent exploitation.
Since the vulnerability arises from unbounded input processing on stdin, avoid allowing untrusted or unfiltered input to be piped into this binary.
Applying vendor patches or updates that fix the unbounded input handling in the `read_cookie()` function is the recommended long-term solution.
If patches are not immediately available, consider disabling or restricting the use of the setuid helper binary or using alternative authentication methods that do not invoke this vulnerable helper.