CVE-2026-85498

What it actually does

Integer underflow in authentication agent helper buffer length calculation when processing input beginning with a null byte, resulting in out-of-bounds memory read and potential application crash.

Why it matters to the business

Local denial-of-service condition that can disrupt authentication and privilege-escalation workflows on affected systems, requiring restarts and potentially interrupting dependent services; patch released one day after disclosure reduces exposure window.

How an attack unfolds

An attacker with local access supplies specially crafted input prefixed with a null byte to the polkit authentication agent helper; the arithmetic error triggers an integer underflow during length computation, causing an out-of-bounds read that crashes the process.

How to fix it

Upgrade polkit-main (redhat) to version 127-5.1.hum1 as provided in RHSA-2026:66287; restart affected services after installation.

How to confirm the fix worked

Verify installed polkit package version matches or exceeds 127-5.1.hum1 and confirm absence of the vulnerable buffer-handling code path through package manager queries or source inspection.

Typical attack path

1. Obtain local access or ability to interact with polkit
2. Craft input beginning with a null byte targeting the authentication agent helper
3. Trigger the arithmetic error and integer underflow
4. Induce out-of-bounds read leading to process crash

How to detect it

Review system and authentication logs for repeated polkit crashes or segfaults coinciding with authentication attempts; correlate with process termination events in audit or syslog sources.

What your security team should do

• Apply the vendor update to 127-5.1.hum1 without delay
• Monitor system logs for polkit process crashes or unexpected restarts
• Restrict untrusted local input sources to polkit interfaces until patched