Summary
PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API.
Security Fix(es):
* PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | PackageKit | 1.2.6-2.el9_7 |
| AlmaLinux · 9 | PackageKit-command-not-found | 1.2.6-2.el9_7 |
| AlmaLinux · 9 | PackageKit-glib | 1.2.6-2.el9_7 |
| AlmaLinux · 9 | PackageKit-glib-devel | 1.2.6-2.el9_7 |
| AlmaLinux · 9 | PackageKit-gstreamer-plugin | 1.2.6-2.el9_7 |
| AlmaLinux · 9 | PackageKit-gtk3-module | 1.2.6-2.el9_7 |
Vulnerabilities 1
-
High 8.8CVE-2026-41651 Public exploit
PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root
PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) rac…