Summary
[1.2.6-2.0.1]
- remove RHEL vendor patch PackageKit-0.3.8-RHEL-Vendor.conf.patch
[1.2.6-2]
- Backport fix for CVE-2026-41651.
- Resolves: #RHEL-170502
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | PackageKit | 0:1.2.6-2.0.1.el9_7 |
| Oracle Linux · 9 | PackageKit-command-not-found | 0:1.2.6-2.0.1.el9_7 |
| Oracle Linux · 9 | PackageKit-glib | 0:1.2.6-2.0.1.el9_7 |
| Oracle Linux · 9 | PackageKit-glib-devel | 0:1.2.6-2.0.1.el9_7 |
| Oracle Linux · 9 | PackageKit-gstreamer-plugin | 0:1.2.6-2.0.1.el9_7 |
| Oracle Linux · 9 | PackageKit-gtk3-module | 0:1.2.6-2.0.1.el9_7 |
Vulnerabilities 1
-
High 8.8CVE-2026-41651 Public exploit
PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root
PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) rac…