The CVE has a typo; the actual is CVE-2021-4034. https://nvd.nist.gov/vuln/detail/CVE-2021-4034
>The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands.
Oh, for fucks sake.