SB2026090759 - Multiple vulnerabilities in PackageKit

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090759

SB2026090759 - Multiple vulnerabilities in PackageKit

Published: September 7, 2026 Updated: September 10, 2026

Security Bulletin ID SB2026090759
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Medium 14% Low 86%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Improper Verification of Cryptographic Signature (CVE-ID: N/A)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to install an unsigned local package.

The vulnerability exists due to an incorrect comparison of transaction flag bitfields in the ALPM backend InstallFiles path when processing an InstallFiles transaction with ONLY_TRUSTED set. A local user can submit a local package file through the transaction to install an unsigned local package.

Exploitation requires an existing cached PolicyKit authorization for the trusted package-install action and a package file path readable by the PackageKit daemon.


2) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cancel pending offline updates.

The vulnerability exists due to missing authorization in the packagekitd offline-update Trigger method when handling an unset action on the system bus. A local user can call the method with the unset action to cancel pending offline updates.

An administrator-authorized offline update must already be armed.


3) Incorrect authorization (CVE-ID: CVE-2026-19816)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to remove installed packages.

The vulnerability exists due to incorrect authorization in the dnf5 backend RepoRemove handler when processing RepoRemove transactions with the SIMULATE flag. A local user can invoke RepoRemove with the SIMULATE flag to remove installed packages.

Only systems using the PackageKit dnf5 backend are affected. Setting autoremove to true can remove packages installed from the specified repository and sibling repository IDs sharing the same repository file.


4) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: N/A)

CWE-ID: CWE-88 - Argument Injection or Modification

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code as root.

The vulnerability exists due to improper neutralization of argument delimiters in the PackageKit spawn dispatcher command stream when processing SearchNames D-Bus requests. A local user can send a SearchNames value containing control characters to inject a privileged backend command and execute arbitrary code as root.

Exploitation requires a reused backend helper and a Python-dispatcher spawn backend, such as eopkg, pisi, entropy, or portage.


5) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to missing enforcement of trusted package requirements in the PackageKit dnf5 backend transaction handling when processing trusted update transactions for staged @commandline RPMs. A local user can stage an unsigned local RPM and request a trusted update to escalate privileges.

Exploitation requires an active local-console session; an SSH-only session is insufficient.


6) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper path validation and symlink following in the PackageKit dnf5 backend and libdnf5 TempFilesMemory temporary-file tracking logic when processing crafted unauthenticated D-Bus transactions. A local user can supply a path-traversal distro identifier and create a symlink to cause a root-owned file overwrite and escalate privileges.

Exploitation requires access to the system D-Bus from a standard local user session.


7) Missing Authorization (CVE-ID: CVE-2026-55752)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to execute arbitrary code with root privileges.

The vulnerability exists due to missing authorization in the alpm install_files_thread handler when processing install-file transactions with the only_download flag. A local user can submit a package containing a post-install scriptlet to execute arbitrary code with root privileges.

Exploitation requires a relaxed SigLevel configuration.


Remediation

Install update from vendor's website.

References