CVE-2026-19816
HighCVSS 7.1Summary
PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard (role == REPO_REMOVE || !SIMULATE) is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate.
Risk Assessment
An unprivileged local user can remove system packages, causing system instability or denial of service. Only systems using PackageKit with the dnf5 backend are affected.
Recommendation
Upgrade PackageKit to a version containing the fix or temporarily restrict access to RepoRemove operations. Verify whether the system uses the dnf5 backend.
Other vulnerabilities in PackageKit
See all- CVE-2026-10294Medium
A vulnerability has been found in PackageKit up to 1.3.5. Affected is the function g_file_test of the file src/pk-transaction.c of the component API. Such manipulation of the argument frontend-socket leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-41651High
PackageKit versions 1.0.2 through 1.3.4 contain a TOCTOU race condition on transaction flags, allowing unprivileged users to install packages as root. The vulnerability stems from three code issues: unconditional flag overwrite, silent state-transition rejection, and late flag reading at execution time.
Original NVD description (English source)
A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a genuine package uninstall while claiming to simulate. This vulnerability only affects systems using PackageKit with the dnf5 backend.