CVE-2026-85498 Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-85498?
CVE-2026-85498 is a low-severity vulnerability in Red Hat Enterprise Linux 10, published on 29 Oct 2026.
Official description
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).
Weakness: CWE-125
Which versions are affected by CVE-2026-85498?
Linux distribution packages (1)
polkit openSUSE:Tumbleweed | All versions | 128-1.1 |
How do I fix CVE-2026-85498?
Upgrade to a fixed version.
Is CVE-2026-85498 being exploited?
There is no known exploitation of CVE-2026-85498 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-85498, GHSA-cvc4-pw4g-cgpc, MGASA-2026-0485, OESA-2026-4000, OESA-2026-4001, OESA-2026-4002 and 5 more.