CVE-2026-85498: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-85498 is a stack buffer underflow (out-of-bounds read) vulnerability in polkit, specifically a regression introduced by the fix for CVE-2026-4897. The flaw resides in the read_cookie() function within /src/polkitagent/polkitagenthelperprivate.c, where an unbounded getline() call was replaced with fgets(), inadvertently introducing a size_t underflow condition. Red Hat has assigned a preliminary CVSS v3.1 base score of 4.6 (Medium), with the CVE status listed as Reserved and under active investigation (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read). In the patched version of polkit (upstream commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c), fgets() is used to read cookie data from stdin. Unlike getline(), fgets() copies bytes verbatim and does not stop at embedded NUL bytes. If the first byte read from stdin is 0x00, then buf[0] == '\0' and strlen(buf) returns 0; the expression strlen(buf) - 1 then underflows (size_t)0 - 1 to SIZE_MAX, causing buf[SIZE_MAX] — an out-of-bounds read of one byte immediately before the stack buffer (buf[-1]). On 64-bit two's-complement systems, the pointer arithmetic wraps modulo 2^64, making this a one-byte stack read before the buffer (Red Hat Bugzilla). The attack vector is Adjacent Network with Low privileges required, per Red Hat's preliminary CVSS assessment (Red Hat CVE).

Successful exploitation of this vulnerability can result in limited confidentiality impact (reading one byte of stack memory before the buffer) and potential availability impact (crash/segmentation fault). The out-of-bounds read could theoretically leak memory addresses or other sensitive values from the stack, potentially aiding in bypassing ASLR or other memory protection mechanisms in chained attacks. Integrity is not directly impacted. The scope is unchanged, limiting blast radius to the affected polkit agent process (Red Hat CVE, Red Hat Bugzilla).

As of the time of this report, CVE-2026-85498 is newly disclosed (published 2026-09-04) and its status is Reserved. No public proof-of-concept exploit code, in-the-wild exploitation, or threat actor attribution has been reported. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No EPSS score is currently available. Red Hat's investigation is ongoing (Red Hat CVE, Red Hat Bugzilla).

Red Hat Product Security is actively investigating the affected products and has not yet released a fixed package version at the time of disclosure. The upstream regression was introduced in polkit commit 7e122c8a5120c2aae2d9d44a26796dc18f5b677c; administrators should monitor Red Hat advisories for errata updates. As an interim measure, restrict access to polkit agent interfaces and limit local/adjacent network access to privileged authentication endpoints. Upgrading to a patched polkit version once released by the upstream project or Red Hat is the recommended remediation (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was reported via Red Hat's OSIDB Bzimport process and is currently under investigation by Red Hat Product Security. No notable public researcher commentary, social media discussion, or broader media coverage has been identified at this time, consistent with the CVE's newly reserved status (Red Hat Bugzilla).