Critical Security Flaw in PackageKit: Race Condition Vulnerability Allows Arbitrary Package Installation
Summary
RLSA-2026:19141: Important: PackageKit security update. Affects PackageKit versions < 0:1.2.8-8.el10. Fixed in 0:1.2.8-8.el10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PackageKit is a D-Bus abstraction layer designed to facilitate secure package management for users across various Linux distributions and architectures. It provides a unified API for package management tasks, enabling users to install, update, and remove software packages seamlessly. However, a critical vulnerability has been identified that could allow unauthorized users to install packages with root privileges, posing significant security risks to systems utilizing this package.
Vulnerability Detail
The vulnerability, identified as CVE-2026-41651, arises from a race condition within PackageKit. This flaw can be exploited by an attacker to execute arbitrary package installations as the root user, potentially leading to unauthorized access, system compromise, and the installation of malicious software. The technical details indicate that the race condition allows for manipulation of package management operations, which can be triggered under specific timing conditions, making it a serious concern for system administrators.
How To Fix
Minimum fixed version
0:1.2.8-8.el10
This is the first release that contains the fix.
sudo dnf update PackageKitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the PackageKit service or limit the permissions of users who can invoke package management operations until the update can be applied. This can be done by modifying user roles and permissions in the system settings.
Conclusion
The discovery of CVE-2026-41651 in PackageKit highlights a significant security risk that could allow unauthorized package installations. It is crucial for users to update to the patched version to mitigate this vulnerability and protect their systems from potential exploitation.
See every vulnerability recorded for PackageKit →
FAQ
CVE-2026-41651 is a critical vulnerability in PackageKit that allows unauthorized users to install packages as root due to a race condition.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized access, installation of malicious software, and overall compromise of the affected system.
Yes, a patch is available in the form of an updated PackageKit version 0:1.2.8-8.el10. Users should update their packages to this version.
The CVSS score for CVE-2026-41651 is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for PackageKit.
