new file mode 100644
@@ -0,0 +1,64 @@
+From 7e122c8a5120c2aae2d9d44a26796dc18f5b677c Mon Sep 17 00:00:00 2001
+From: Jan Rybar <jrybar@redhat.com>
+Date: Fri, 27 Mar 2026 15:57:01 +0100
+Subject: [PATCH] CVE-2026-4897 - getline() string overflow
+
+Report and fix by Aisle.com
+Pavel Kohout, Aisle Research
+
+Signed-off-by: Jan Rybar jrybar@redhat.com
+
+CVE: CVE-2026-4897
+Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/7e122c8a5120c2aae2d9d44a26796dc18f5b677c]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/polkitagent/polkitagenthelperprivate.c | 23 +++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c
+index 35bca85..7e4f94e 100644
+--- a/src/polkitagent/polkitagenthelperprivate.c
++++ b/src/polkitagent/polkitagenthelperprivate.c
+@@ -24,6 +24,7 @@
+ #include <stdio.h>
+ #include <string.h>
+ #include <stdlib.h>
++#include <errno.h>
+ #include <unistd.h>
+
+ #ifndef HAVE_CLEARENV
+@@ -59,21 +60,25 @@ read_cookie (int argc, char **argv)
+ return strdup (argv[2]);
+ else
+ {
+- char *ret = NULL;
+- size_t n = 0;
+- ssize_t r = getline (&ret, &n, stdin);
+- if (r == -1)
++ #define POLKIT_AGENT_MAX_COOKIE 4096
++ char buf[POLKIT_AGENT_MAX_COOKIE + 2]; /* +1 for newline, +1 for NUL */
++ if (fgets (buf, sizeof(buf), stdin) == NULL)
+ {
+ if (!feof (stdin))
+- perror ("getline");
+- free (ret);
++ perror ("fgets");
+ return NULL;
+ }
+- else
++ if (buf[strlen (buf) - 1] != '\n')
+ {
+- g_strchomp (ret);
+- return ret;
++ /* Cookie too long - drain remaining input and reject */
++ int c;
++ while ((c = getchar ()) != '\n' && c != EOF)
++ ;
++ errno = EOVERFLOW;
++ return NULL;
+ }
++ g_strchomp (buf);
++ return strdup (buf);
+ }
+ }
+
new file mode 100644
@@ -0,0 +1,32 @@
+From 39601309eb3e5e88a1c1fbda9a272ba8691f1bf3 Mon Sep 17 00:00:00 2001
+From: Jan Rybar <jrybar@redhat.com>
+Date: Wed, 13 May 2026 14:58:32 +0200
+Subject: [PATCH] Draining loop can keep polkit busy
+
+The draining loop is not really appropriate for pipe input, especially
+in a daemon.
+
+Co-authored-by: Frantisek Sumsal <fsumsal@redhat.com>
+
+CVE: CVE-2026-4897
+Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/39601309eb3e5e88a1c1fbda9a272ba8691f1bf3]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/polkitagent/polkitagenthelperprivate.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c
+index 7e4f94e..c0a9825 100644
+--- a/src/polkitagent/polkitagenthelperprivate.c
++++ b/src/polkitagent/polkitagenthelperprivate.c
+@@ -70,10 +70,6 @@ read_cookie (int argc, char **argv)
+ }
+ if (buf[strlen (buf) - 1] != '\n')
+ {
+- /* Cookie too long - drain remaining input and reject */
+- int c;
+- while ((c = getchar ()) != '\n' && c != EOF)
+- ;
+ errno = EOVERFLOW;
+ return NULL;
+ }
new file mode 100644
@@ -0,0 +1,38 @@
+From eea172967848bb4c5a407329f40c0e45de0d187e Mon Sep 17 00:00:00 2001
+From: Jan Rybar <jrybar@redhat.com>
+Date: Thu, 27 Aug 2026 15:02:45 +0200
+Subject: [PATCH] CVE-2026-85498: Unsanitized underflow in cookie input
+
+Credits for the report:
+Sunwoo Lee, Korea Institute of Energy Technology (KENTECH)
+Daeyoung Kang, Korea Institute of Energy Technology (KENTECH)
+Haeryong Park, Korea Internet & Security Agency (KISA)
+Hyuk Lim, Korea Institute of Energy Technology (KENTECH)
+Seunghyun Yoon, Korea Institute of Energy Technology (KENTECH)
+Juthawong Naisanguansee
+
+Co-authored-by: Jan Rybar <jrybar@redhat.com>
+
+CVE: CVE-2026-85498
+Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/eea172967848bb4c5a407329f40c0e45de0d187e]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/polkitagent/polkitagenthelperprivate.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c
+index c0a9825..e2d2c9b 100644
+--- a/src/polkitagent/polkitagenthelperprivate.c
++++ b/src/polkitagent/polkitagenthelperprivate.c
+@@ -68,6 +68,11 @@ read_cookie (int argc, char **argv)
+ perror ("fgets");
+ return NULL;
+ }
++ if (buf[0] == '\0')
++ {
++ errno = EINVAL;
++ return NULL;
++ }
+ if (buf[strlen (buf) - 1] != '\n')
+ {
+ errno = EOVERFLOW;
@@ -5,7 +5,12 @@ LICENSE = "LGPL-2.0-or-later"
LIC_FILES_CHKSUM = "file://COPYING;md5=155db86cdbafa7532b41f390409283eb"
BUGTRACKER = "https://github.com/polkit-org/polkit/issues"
-SRC_URI = "git://github.com/polkit-org/polkit.git;protocol=https;branch=main;tag=${PV}"
+SRC_URI = "\
+ git://github.com/polkit-org/polkit.git;protocol=https;branch=main;tag=${PV} \
+ file://CVE-2026-4897-01.patch \
+ file://CVE-2026-4897-02.patch \
+ file://CVE-2026-85498.patch \
+"
SRCREV = "9e4894c969eecf26a3ba762f4f7a268aa0fb3e51"