Critical Security Flaw in PackageKit: Race Condition Vulnerability Leading to Arbitrary Package Installation
Summary
ALSA-2026:19354: Important: PackageKit security update. Affects PackageKit versions < 1.2.6-2.el9_8. Fixed in 1.2.6-2.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PackageKit is a D-Bus abstraction layer designed to facilitate secure package management for users across various Linux distributions. It provides a unified API that simplifies the installation, updating, and removal of software packages, regardless of the underlying architecture. However, a recently identified race condition vulnerability poses significant security risks, allowing unauthorized package installations with root privileges.
Vulnerability Detail
The vulnerability stems from a race condition within PackageKit, which can be exploited to perform arbitrary package installations as the root user. This flaw can lead to unauthorized access and control over the system, potentially allowing attackers to install malicious software or compromise system integrity. The vulnerability is tracked under CVE-2026-41651, and it affects multiple components of PackageKit, including its command-not-found feature and GTK3 module.
How To Fix
Minimum fixed version
1.2.6-2.el9_8
This is the first release that contains the fix.
sudo dnf update PackageKitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the PackageKit service or limit user permissions to prevent unauthorized package installations until the update is applied. However, this is not a permanent solution and should be followed by an update as soon as possible.
Conclusion
The identified race condition vulnerability in PackageKit poses a significant risk, allowing unauthorized package installations with root privileges. Users are strongly advised to update their PackageKit installations to the latest patched version to mitigate this risk. Temporary workarounds can be employed, but they should not replace the necessity of applying the update.
See every vulnerability recorded for PackageKit →
FAQ
PackageKit is a D-Bus abstraction layer that allows users to manage software packages securely across different Linux distributions.
The race condition vulnerability allows attackers to exploit timing issues in the PackageKit process to install packages with root privileges without authorization.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider restricting access to PackageKit or limiting user permissions as a temporary workaround.
For detailed information about the CVE-2026-41651 vulnerability, refer to the official CVE page or security advisories related to PackageKit.
Related vulnerabilities
Recent vulnerabilities recorded for PackageKit.
