CVE-2026-19816: PackageKit Privilege Escalation Vulnerability

CVE-2026-19816 Overview

CVE-2026-19816 is an authorization bypass vulnerability in PackageKit's dnf5 backend. PackageKit skips the polkit authorization check when a transaction carries the SIMULATE (dry-run) flag. The RepoRemove handler in the dnf5 backend contains a flawed guard expression, (role == REPO_REMOVE || !SIMULATE), which always evaluates to true for RepoRemove operations. As a result, an unprivileged local user can execute a real package uninstall while claiming to only simulate it. The flaw is tracked under [CWE-863: Incorrect Authorization]. Only systems using PackageKit with the dnf5 backend are affected.

Critical Impact
An unprivileged local user can uninstall packages without polkit authorization, damaging system integrity and availability on affected Linux systems.

Affected Products

PackageKit when configured with the dnf5 backend
Linux distributions shipping PackageKit with dnf5 (see Red Hat Bugzilla)
Downstream builds referenced in the GitHub PackageKit Security Advisory

Discovery Timeline

2026-09-14 - CVE-2026-19816 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-19816

Vulnerability Analysis

PackageKit exposes a D-Bus service that brokers package management operations for desktop clients. Sensitive actions require polkit authorization to elevate privileges. To support user-facing preview features, PackageKit intentionally skips polkit authorization when the caller sets the SIMULATE flag on a transaction. Backends are expected to honor that contract by refusing to perform real changes when the flag is set.

The dnf5 backend violates this contract in its RepoRemove handler. The condition intended to permit execution only when the operation is a repository remove or when simulation is not requested is written as (role == REPO_REMOVE || !SIMULATE). Because role == REPO_REMOVE is true in this handler, the short-circuit evaluation makes the expression unconditionally true. The handler proceeds to invoke the actual removal path regardless of the SIMULATE flag.

Root Cause

The root cause is a logic error in the authorization guard within the dnf5 backend combined with the design choice to skip polkit for simulated transactions. A local caller can therefore invoke RepoRemove with the SIMULATE flag set, bypass the polkit prompt, and trigger a real uninstall. This is a classic [CWE-863] incorrect authorization pattern where the check exists but the predicate never denies the sensitive path.

Attack Vector

Exploitation requires only local, low-privileged access to the D-Bus session where PackageKit is reachable. No user interaction is needed. The attacker sends a RepoRemove transaction with the SIMULATE flag set, and PackageKit executes the removal without prompting for credentials. Refer to the GitHub PackageKit Commit Update for the corrected guard logic and the Red Hat Bug Report #2515940 for downstream tracking.

Detection Methods for CVE-2026-19816

Indicators of Compromise

Unexpected dnf5 transaction history entries showing package or repository removals not tied to an administrator session.
PackageKit D-Bus method calls to RepoRemove originating from unprivileged user sessions.
Absence of corresponding polkit authorization records in journalctl for observed removal transactions.

Detection Strategies

Correlate PackageKit transaction logs (/var/log/PackageKit/transactions.db) with polkit authorization events to identify removals executed without an authorization decision.
Monitor dnf5 history (dnf5 history list) for removals initiated outside change windows or by non-administrative UIDs.
Audit D-Bus traffic on the system bus for calls to org.freedesktop.PackageKit methods carrying the SIMULATE transaction flag.

Monitoring Recommendations

Ship PackageKit, polkit, and dnf5 logs to a centralized SIEM and alert on removals lacking a matching polkit CheckAuthorization result.
Baseline installed package inventory and alert on unauthorized deletions of security-relevant packages such as auditing, EDR, or SSH components.
Track process ancestry for packagekitd child processes invoking dnf5 removal operations under unexpected user contexts.

How to Mitigate CVE-2026-19816

Immediate Actions Required

Apply the vendor patch referenced in the GitHub PackageKit Security Advisory as soon as your distribution publishes an updated package.
Restrict interactive local access on multi-user systems until patched builds are deployed.
Review recent dnf5 transaction history on affected hosts to identify unauthorized removals and restore missing packages.

Patch Information

The upstream fix corrects the guard in the dnf5 backend so the SIMULATE flag is honored for RepoRemove and other transaction roles. See the GitHub PackageKit Commit Update for the exact code change and the Red Hat Bug Report #2515940 for distribution-specific package availability.

Workarounds

Temporarily switch PackageKit to a non-dnf5 backend if the distribution supports it, since the flaw is specific to dnf5.
Tighten polkit rules for org.freedesktop.packagekit.package-remove and related actions to require administrator authentication regardless of the SIMULATE flag.
Disable or mask the packagekit.service unit on servers that do not require desktop-driven package management.

bash

# Configuration example: mask PackageKit on systems that do not need it
sudo systemctl mask --now packagekit.service

# Verify current backend in use
grep -i '^DefaultBackend' /etc/PackageKit/PackageKit.conf