CVE-2026-4897: freedesktop polkit
CVSS: 5.5v3.1MediumModified
AliasesMGASA-2026-0085SUSE-SU-2026:1424-1SUSE-SU-2026:1425-1SUSE-SU-2026:20969-1SUSE-SU-2026:21032-1SUSE-SU-2026:22054-1SUSE-SU-2026:22090-1RHSA-2026:59997UBUNTU-CVE-2026-4897DEBIAN-CVE-2026-4897openSUSE-SU-2026:20925-1
Published 26-03-2026Last modified 10-09-2026
Vulnerability summary
CVE-2026-4897 is a medium (CVSS 5.5) vulnerability in freedesktop polkit. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.8% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.15%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 26-03-2026PublishedVulnerability first disclosed.
- 10-09-2026Last modifiedVulnerability information updated.
Description
A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 5.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · Red hatEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.15%
Chance of exploitation in the next 30 days
Percentile
4%
Versus all other CVEs
30-day change
0.00 pp
From 0.15% on 20-09-2026
20-09-202620-10-2026
EPSS score0.15%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat9 products
- enterprise_linuxEOL6.0 | 7.0 | 8.0 | 9.0 | 10.0
- openshift_container_platform4.0
- polkit< 0:125-4.el10_2.1
- polkit-debuginfo< 0:125-4.el10_2.1
- polkit-debugsource< 0:125-4.el10_2.1
Suse9 products
- expat&distro=SUSE Linux Micro 6.2< 2.7.1-160000.5.1
- polkit&distro=SUSE Linux Enterprise Micro 5.5< 121-150500.3.11.1
- polkit&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 121-150500.3.11.1
- polkit&distro=SUSE Linux Enterprise Server 16.0< 123-160000.3.1
- polkit&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 123-160000.3.1
Opensuse2 products
- polkit&distro=openSUSE Leap 15.6< 121-150500.3.11.1
- polkit&distro=openSUSE Leap 16.0< 123-160000.3.1
Debian1 product
- policykit-1All versions (No fix recorded) | < 127-3
Freedesktop1 product
- polkitna
Mageia1 product
- polkit< 122-2.1.mga9
Ubuntu1 product
- policykit-1All versions (No fix recorded) | < 0.105-33ubuntu0.1 | < 124-2ubuntu1.24.04.3 | < 126-2ubuntu0.1
7 vendors · 24 products
