Multiple Denial of Service Vulnerabilities in polkit Affect Ubuntu Systems

• •Two critical vulnerabilities in polkit affect multiple Ubuntu versions.
• •CVE-2025-7519 allows remote denial of service via malicious XML policy files.
• •CVE-2026-4897 enables local denial of service through mishandled input.

Two significant vulnerabilities have been identified in polkit, affecting multiple Ubuntu releases, including 25.10, 24.04 LTS, and 22.04 LTS. The first vulnerability (CVE-2025-7519), discovered in July 2025, allows remote attackers to exploit improperly handled nested XML elements, potentially causing a denial of service if an administrator installs a malicious policy file. The second vulnerability (CVE-2026-4897), reported by Pavel Kohout in March 2026, involves the polkit-agent-helper-1 utility mishandling long input, which could also lead to a denial of service by local attackers. Both vulnerabilities pose a risk of system crashes, impacting the stability of affected systems. Users are advised to update their systems to mitigate these vulnerabilities. A standard system update will address these issues across the affected Ubuntu versions.