Back Linuxsecurity

Fedora PackageKit 1.4.0 Update CVE-2026

Linuxsecurity •LinuxSecurity Advisories • September 13, 2026

Share: View original

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

PackageKit is a D-Bus abstraction layer that allows the session user

to manage packages in a secure way using a cross-distro,

cross-architecture API.

Update to 1.4.0 to fix CVE-2026-19816, GHSA-pwvr-2q5v-xvw4, GHSA-6759-8c43-4xrv, GHSA-6695-qjj5-533m, GHSA-gmhf-fxfx-m2w9

* Fri Sep 11 2026 Neal Gompa - 1.4.0-1 - Update to 1.4.0 - Add patch to use RepoConfigOverride API to support repo config in /usr * Wed Jul 15 2026 Fedora Release Engineering - 1.3.6-3 - Rebuilt for * Thu Jun 25 2026 František Zatloukal - 1.3.6-2 - Rebuilt for fmt/spdlog

[ 1 ] Bug #2434442 - PackageKit-1.4.0 is available

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-6cf9691266' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in PackageKit Affect Fedora Systems Fedora PackageKit version 1.4.0 has been released to address multiple vulnerabilities, including CVE-2026-19816. This update affects Fedora 44 and 45 systems, allowing users to manage packages securely via a D-Bus abstraction layer. The vulnerabilities could potentially allow unauthorized access or manipulation of package management functions. Users are urged to upgrade to version 1.4.0 to mitigate these risks. The update includes patches for several security issues, identified by CVEs and GitHub Security Advisories. The vulnerabilities were confirmed by Neal Gompa, a Fedora developer, on September 11, 2026. The update can be installed using the 'dnf' package manager with specific commands provided in the advisories. Current status indicates that the vulnerabilities are patched, but users must act promptly to secure their systems. 2 sources 34

Extracted Entities

CVEs (1)

CVE-2026-19816

Platforms (1)

Linux