Skip to content
OpenAdvisories
High RHSA-2026:18031 1 CVE

Red Hat Security Advisory: PackageKit security update

Published May 19, 2026 · Updated Jun 30, 2026

Ecosystem: Red Hat

Fixed packages 18

ReleasePackageFixed in
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream PackageKit 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream PackageKit-command-not-found 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream PackageKit-command-not-found-debuginfo 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream PackageKit-debuginfo 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream PackageKit-debugsource 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream PackageKit-glib 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream PackageKit-glib-debuginfo 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream PackageKit-gstreamer-plugin 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream PackageKit-gstreamer-plugin-debuginfo 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream PackageKit-gtk3-module 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream PackageKit-gtk3-module-debuginfo 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb PackageKit-command-not-found-debuginfo 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb PackageKit-debuginfo 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb PackageKit-debugsource 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb PackageKit-glib-debuginfo 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb PackageKit-glib-devel 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb PackageKit-gstreamer-plugin-debuginfo 0:1.2.6-1.el9_6.1
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb PackageKit-gtk3-module-debuginfo 0:1.2.6-1.el9_6.1

Vulnerabilities 1

  • High 8.8
    CVE-2026-41651 Public exploit

    PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root

    PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) rac…

    PackageKit PackageKit packagekit packagekit Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2460604
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18031.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-41651
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-41651
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-41651
  • article
    https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L2273-L2277
  • article
    https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L4036
  • article
    https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L873-L882
  • article
    https://github.com/PackageKit/PackageKit/security/advisories/GHSA-f55j-vvr9-69xv
  • article
    https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html