This vulnerability involves the allocation of resources without limits or throttling in the polkit-agent-helper-1 setuid binary on Red Hat Enterprise Linux 10. A local attacker can provide a specially crafted, excessively long input through standard input, which causes the process to consume excessive memory and potentially trigger an out-of-memory condition. This results in a denial of service affecting system availability. The CVSS vector indicates low attack complexity and low privileges required, with no impact on confidentiality or integrity but a high impact on availability.

The impact is a denial of service condition caused by out-of-memory triggered by unbounded input processing in polkit-agent-helper-1. This affects system availability but does not compromise confidentiality or integrity. The attack requires local access with low privileges and no user interaction is needed beyond supplying the input.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-4897 for current remediation guidance. Until an official fix is available, consider restricting local user access to the polkit-agent-helper-1 binary or monitoring for abnormal resource usage related to polkit processes. Do not assume the vulnerability is mitigated without vendor confirmation.