SUSE-SU-2026:1939-1

HIGH8.8

Security update for PackageKit

Published May 18, 2026

Modified 2 weeks ago

Fix available

Details

Description of the patch:

This update for PackageKit fixes the following issue:

CVE-2026-41651: race condition allows for arbitrary RPM package installation as root and can lead to LPE (bsc#1262220).

Affected Packages

PackageKit

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

1.2.8-150600.4.14.1

PackageKit-backend-zypp

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

1.2.8-150600.4.14.1

PackageKit-devel

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

1.2.8-150600.4.14.1

PackageKit-lang

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

1.2.8-150600.4.14.1

libpackagekit-glib2-18

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

1.2.8-150600.4.14.1

libpackagekit-glib2-devel

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

1.2.8-150600.4.14.1

typelib-1_0-PackageKitGlib-1_0

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

1.2.8-150600.4.14.1

PackageKit-gstreamer-plugin

SUSE Linux Enterprise Workstation Extension 15 SP7

Fixed in:

1.2.8-150600.4.14.1

PackageKit-gtk3-module

SUSE Linux Enterprise Workstation Extension 15 SP7

Fixed in:

1.2.8-150600.4.14.1

References

https://bugzilla.suse.com/1262220

https://lists.suse.com/pipermail/sle-updates/2026-May/046544.html

https://www.suse.com/security/cve/CVE-2026-41651/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2026/suse-su-20261939-1/

CVSS Analysis

CVSS v3.1

8.8

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.8/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Upstream

Ecosystems

SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 15 SP6-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP7

Timeline

PublishedMay 18, 2026

ModifiedMay 18, 2026

SUSE-SU-2026:1939-1 | Mondoo Vulnerability Intelligence