CVE-2026-4897: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-4897 is a Denial of Service (DoS) vulnerability in polkit (PolicyKit) caused by unbounded input processing in the polkit-agent-helper-1 setuid binary. A local user with low privileges can pipe an excessively long input to the binary via standard input (stdin), triggering an out-of-memory (OOM) condition that renders the system unavailable. The vulnerability was first published on March 26, 2026, with patches available as of April 2, 2026. Affected software includes freedesktop polkit (versions approximately 0.113 and later using the setuid helper), Red Hat Enterprise Linux 6.0–10.0, Red Hat OpenShift Container Platform 4.0, and Microsoft Azure Linux (azl3/cbl2) polkit packages. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla, Microsoft MSRC).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in the read_cookie() function within src/polkitagent/polkitagenthelperprivate.c. When polkit-agent-helper-1 is invoked with only a username argument (argc == 2), it reads the authentication cookie from stdin using getline(), which performs unbounded memory reallocation as it reads input with no newline terminator. Although the helper checks whether stdin is a TTY (to prevent misuse), this check occurs after read_cookie() has already returned — meaning the unbounded allocation has already taken place. The binary is installed setuid root (mode 04755), so any local user can execute it and pipe arbitrarily large data to trigger OOM. The stdin path was introduced in commit ea544ffc (approximately polkit 0.113) and affects all helper variants (PAM, shadow, bsdauth) that share this code path (Red Hat Bugzilla).

Successful exploitation causes a system-wide Denial of Service by exhausting available memory, potentially crashing or severely degrading the affected host. The attack requires only local access with low privileges and no user interaction, making it accessible to any unprivileged local user on an affected system. There is no confidentiality or integrity impact; the vulnerability is limited to availability (HIGH) (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low exploitation probability, the attack is conceptually straightforward — any local user can trigger it with a simple one-liner using standard tools like python3 and a pipe (Red Hat Bugzilla).

1. Identify a vulnerable system: Confirm the target runs a Linux distribution with polkit ≥ 0.113 using the setuid polkit-agent-helper-1 binary (check with ls -l /usr/lib/polkit-1/polkit-agent-helper-1 for mode 04755).
2. Obtain local access: Log in as any low-privileged local user — no elevated privileges are required.
3. Craft oversized input: Prepare a very large input string without a newline character to prevent getline() from terminating, forcing continuous memory reallocation. Example: python3 -c "print('A'*200000000, end='')" generates ~200 MB of data.
4. Pipe input to the setuid binary: Execute the following command: python3 -c "print('A'*200000000, end='')" | /usr/lib/polkit-1/polkit-agent-helper-1 $(whoami)
5. Trigger OOM condition: The getline() call in read_cookie() continuously reallocates memory until the system's available memory is exhausted, triggering the OOM killer and causing a system-wide Denial of Service (Red Hat Bugzilla).

• Process: Unusual invocations of /usr/lib/polkit-1/polkit-agent-helper-1 by non-root, non-agent users, especially with stdin connected to a pipe rather than a terminal.
• Logs: OOM killer events in /var/log/kern.log or dmesg output (e.g., Out of memory: Kill process entries) coinciding with polkit-agent-helper-1 execution; system logs showing sudden memory exhaustion without a clear workload cause.
• System Metrics: Rapid spike in memory consumption visible via top, free, or monitoring tools, attributed to the polkit-agent-helper-1 process.
• Audit Logs: Linux audit log entries (/var/log/audit/audit.log) showing execve syscalls for polkit-agent-helper-1 from unexpected user sessions or at unusual times (Red Hat Bugzilla).

Apply vendor-supplied patches as the primary remediation. Patches were made available starting April 2, 2026, from multiple vendors: Microsoft (azl3_polkit_123-4, cbl2_polkit_0.119-4), Red Hat Enterprise Linux (6.0–10.0), Fedora, openSUSE/SUSE, Ubuntu (USN-8173-1), Amazon Linux 2023 (ALAS2023-2026-1546), Debian (DLA-4553-1), and Mageia. As a temporary workaround, restrict local user access to affected systems where possible, and consider using system-level resource limits (e.g., ulimit or cgroups memory limits) to cap memory usage for unprivileged users. Monitor systems for unusual memory consumption or OOM events that may indicate exploitation attempts (Red Hat CVE, Microsoft MSRC).

The vulnerability received coverage across multiple Linux security news outlets including LinuxSecurity.com, pro-linux.de, and linuxcompatible.org, reflecting broad awareness in the Linux community. Multiple distribution vendors — including Red Hat, SUSE, Ubuntu, Fedora, Debian, Amazon Linux, and Mageia — issued security advisories and patches, indicating coordinated disclosure and rapid vendor response. Social media activity was limited, with a brief mention on Bluesky via the CVE tracking account. Overall community sentiment treats this as a moderate-severity local DoS issue with straightforward remediation (Red Hat CVE, Microsoft MSRC).