Critical Race Condition Vulnerability in PackageKit: Arbitrary Package Installation Risk
Summary
ALSA-2026:11504: Important: PackageKit security update. Affects PackageKit versions < 1.2.6-2.el9_7. Fixed in 1.2.6-2.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PackageKit is a D-Bus abstraction layer designed to facilitate secure package management for users across various Linux distributions and architectures. It provides a unified API that allows users to install, update, and remove software packages seamlessly. However, a recently discovered race condition vulnerability poses a significant security risk, enabling unauthorized package installations with root privileges.
Vulnerability Detail
The vulnerability identified as CVE-2026-41651 arises from a race condition within PackageKit, which can be exploited to perform arbitrary package installations as the root user. This flaw can lead to unauthorized access and control over the system, potentially allowing attackers to install malicious software or alter system configurations without user consent. The vulnerability affects multiple components of PackageKit, including its command-not-found utility and various plugins.
How To Fix
Minimum fixed version
1.2.6-2.el9_7
This is the first release that contains the fix.
sudo dnf update PackageKitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the PackageKit service or disable it until the update is applied. This can be done by running
sudo systemctl stop PackageKit.service' and 'sudo systemctl disable PackageKit.service
However, this may limit the ability to manage packages until the vulnerability is resolved.
Conclusion
The discovery of CVE-2026-41651 highlights a critical vulnerability in PackageKit that can lead to unauthorized package installations. Users are strongly advised to update their systems to the patched version to mitigate potential risks. For those unable to update immediately, temporary workarounds are available to help secure their systems.
See every vulnerability recorded for PackageKit →
FAQ
CVE-2026-41651 is a race condition vulnerability in PackageKit that allows unauthorized package installations as root.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is that an attacker could gain root access to your system and install malicious software or alter system configurations.
Yes, a patch is available in the form of an updated PackageKit version 1.2.6-2.el9_7.
If immediate updates are not possible, consider disabling the PackageKit service as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for PackageKit.
