CVE-2025-7519

What it actually does

Out-of-bounds write triggered when polkit processes an XML policy containing 32 or more levels of nested elements, potentially resulting in crashes or arbitrary code execution.

Why it matters to the business

Vulnerable systems risk service crashes or, with administrative access, full compromise; low exploit probability but high impact if a privileged attacker deploys a malicious policy.

How an attack unfolds

An attacker with high-privilege access creates an XML policy file containing excessive nesting depth, places it in the polkit policy directory, and triggers policy processing to induce the out-of-bounds write.

How to fix it

Upgrade polkit to commit 107d3801361b9f9084f78710178e683391f1d245 or linux-lts (Alpaquita:stream) to 6.6.58-r0 or later.

How to confirm the fix worked

Confirm the installed polkit version or commit hash matches a fixed release; attempt to load a test policy with 32+ nested elements and verify absence of crashes or unexpected behavior.

Typical attack path

1. Obtain high-privilege access on the target system
2. Craft an XML policy file with 32 or more nested elements
3. Write the malicious policy file to the polkit configuration directory
4. Trigger policy evaluation to activate the buffer overflow

How to detect it

Review system and application logs for polkit crashes during policy loading; inspect recently modified policy files in configuration directories for unusual XML structure.

What your security team should do

• Apply the listed fixes immediately on all affected systems
• Restrict write access to polkit policy directories to trusted administrators only
• Scan existing policy files for excessive nesting depth