Skip to content
OpenAdvisories
High RLSA-2026:11504 1 CVE

Important: PackageKit security update

Published Apr 30, 2026 · Updated Apr 30, 2026

Ecosystem: Rocky Linux

Summary

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API.

Security Fix(es):

* PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 PackageKit 0:1.2.6-2.el9_7

Vulnerabilities 1

  • High 8.8
    CVE-2026-41651 Public exploit

    PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root

    PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) rac…

    PackageKit PackageKit packagekit packagekit Debian Ubuntu

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2460604