polkit: out-of-bounds write parsing deeply nested XML policy files

CVSS 6.7CVE-2025-7519Kernel, userspace & hypervisorcurated

Impact

polkit's XML policy parser writes out of bounds when a .policy file nests 32 or more elements. The result is at least a crash of the policy engine and, per Red Hat, arbitrary code execution is not ruled out. polkit is the authorisation broker behind systemd, NetworkManager and container tooling on every RHEL-family GPU node, so a crash there breaks privileged operations an operator relies on during maintenance. The saving grace is the precondition: an attacker already needs a high-privilege account to drop a policy file into a directory polkit reads, so this is a privilege-escalation-completion or persistence step rather than an initial foothold. Treat it as hardening on shared bastion and management hosts rather than a tenant-facing hole.

Who can reach it

Local, and requires an already high-privilege account - the attacker must be able to place a malicious .policy file in a polkit policy directory. No network or tenant-pod reachability.

What to do

Apply the distribution polkit update (Red Hat has errata for RHEL 6-10 and OpenShift Container Platform 4); upstream fix is polkit commit 107d3801361b9f9084f78710178e683391f1d245. polkitd is restarted by the package update, so this is a package upgrade plus daemon restart - no reboot and no node drain needed.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-7519 https://access.redhat.com/security/cve/CVE-2025-7519 https://github.com/polkit-org/polkit/commit/107d3801361b9f9084f78710178e683391f1d245 https://bugzilla.redhat.com/show_bug.cgi?id=2379675

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.