This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] PackageKit (an abstraction for APT, DNF, etc.) fixes 1 vulnerability

PackageKit, an abstraction for tools such as APT and DNF [1], fixes a high-severity vulnerability with version 1.3.5 [2]. A fix has also been released by Debian and Ubuntu [3][4]. Red Hat has not yet released a fix for its RHEL systems and recommends blocking PackageKit with the command "systemctl mask packagekit.service" [5]. Individual Debian and Ubuntu releases and their fixed versions: Debian [3]: bullseye (security) - 1.2.2-2+deb11u1 bookworm (security) - 1.2.6-5+deb12u1 trixie (security) - 1.3.1-1+deb13u1 forky, sid - 1.3.5-1 Ubuntu [4]: resolute - 1.3.4-3ubuntu1 questing - 1.3.1-1ubuntu1.1 noble - 1.2.8-2ubuntu1.5 jammy - 1.2.5-2ubuntu3.1

PackageKit - privilege escalation (CVE-2026-41651)
CVSS 8.8 (High)

An authenticated local attacker is able to elevate their privileges and thus execute commands with root rights [2]. Exploitation of the vulnerability has been verified on various desktop and server distributions, including the latest releases of Ubuntu, Debian and Fedora, even with default installation configurations. The exploitation was verified using a PoC script, which has not yet been officially published [6]. Whether the vulnerability has already been exploited on your system can be checked using journalctl; details can be found at [6].

The vulnerability is present in product:

  • PackageKit; >=1.0.2, <1.3.5;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 22. 4. 2026.

By CESNET, z.s.p.o. Martin Krajči on 27. 4. 2026.

CESNET, z.s.p.o. Logo