polkit: integer underflow in the authentication agent helper gives an out-of-bounds read and a crash

Impact

Input beginning with a null byte makes the polkit authentication agent helper underflow a buffer length calculation and read out of bounds, which can crash the process. polkit mediates privileged actions for systemd, libvirt and the usual host management tooling, so a crash loop on a GPU node interferes with the very operations an operator uses to drain, reconfigure or restart workloads on it. Red Hat rates the outcome as denial of service only; there is no claim of code execution or privilege escalation. The record gives an adjacent-network, low-privilege vector with low availability impact.

Who can reach it

A local or adjacent-network caller with low privileges who can feed crafted input to the authentication agent helper. Authentication is required.

What to do

Apply the distribution's polkit update (Red Hat ships it as RHSA-2026:66287) and restart the polkit service, or reboot if the platform's update tooling asks for it. No firmware or GPU driver work; the cost is a package update and a short service restart per node, which can be rolled through a fleet without draining workloads.

References

Related entries

• Linux kernel mlx5_ib (create QP response): mlx5_ib_create_qp_resp is never initialized in create_qp_common, so creatingCVE-2018-20855 · Linux kernel mlx5_ib (create QP response)Low
• Xen on AMD Family 17h / Hygon Family 18h - guest SSBD selection: Setting Speculative Store Bypass Disable on AMD FamilyCVE-2022-42336 · Xen on AMD Family 17h / Hygon Family 18h - guest SSBD selectionLow
• SSSD autofs responder: improper buffer offset during request parsing causes out-of-bounds read and crashCVE-2026-104029 · SSSD autofs responder (request buffer offset calculation)Low
• VMware ESX: insufficient logging lets a malicious administrator perform operations without an audit recordCVE-2026-41709 · VMware ESX (administrative operation audit logging)Low
• OpenSSH sshd: restrict in authorized_keys does not disable tunnel forwarding as documentedCVE-2026-106586 · OpenSSH sshd (restrict keyword in authorized_keys, tunnel forwarding)Low
• OpenSSH sshd: restrict keyword in authorized_keys did not cover tunnel forwardingCVE-2026-73283 · OpenSSH sshd (authorized_keys restrict keyword vs tunnel forwarding)Low