Critical Race Condition Vulnerability in PackageKit: Arbitrary Package Installation Risk
Summary
ALSA-2026:11635: Important: PackageKit security update. Affects PackageKit versions < 1.1.12-8.el8_10. Fixed in 1.1.12-8.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PackageKit is a D-Bus abstraction layer designed to facilitate secure package management for users across various Linux distributions and architectures. It provides a unified API for package management tasks, allowing users to install, update, and remove software packages seamlessly. However, a recently identified race condition vulnerability poses a significant security risk, enabling unauthorized package installations with root privileges.
Vulnerability Detail
The vulnerability, identified as CVE-2026-41651, arises from a race condition within PackageKit that can be exploited to perform arbitrary package installations as the root user. This flaw allows an attacker to manipulate the package management process, potentially leading to the installation of malicious software or unauthorized changes to the system. The implications of this vulnerability are severe, as it undermines the integrity and security of the system, allowing for potential data breaches and system compromises.
How To Fix
Minimum fixed version
1.1.12-8.el8_10
This is the first release that contains the fix.
sudo dnf update PackageKitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the PackageKit service or limit the permissions of users who can invoke package management commands. However, this is not a long-term solution and updating the package is strongly recommended.
Conclusion
The identified race condition vulnerability in PackageKit (CVE-2026-41651) poses a significant risk by allowing arbitrary package installations with root privileges. It is crucial for users to update to the patched version to mitigate this risk and maintain system integrity. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for PackageKit →
FAQ
CVE-2026-41651 is a race condition vulnerability in PackageKit that allows unauthorized package installations as root.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Not fixing this vulnerability can lead to unauthorized software installations, potential data breaches, and overall system compromise.
Yes, a patch is available in version 1.1.12-8.el8_10 of PackageKit and its related packages.
If immediate updates are not possible, consider restricting access to PackageKit or limiting user permissions as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for PackageKit.
