CVE-2026-19816

PackageKit skips the polkit authorization check for transactions flagged SIMULATE (dry-run), assuming simulation is harmless, but the dnf5 backend's RepoRemove handler ignores that contract — its guard (role == REPO_REMOVE || !SIMULATE) is always true for RepoRemove — so the requested 'simulation' executes a genuine package uninstall. An unprivileged local user on an affected host can exploit this to remove arbitrary packages, causing high impact to system integrity and availability (C:N/I:H/A:H, CVSS 3.1: 7.1). Only systems running PackageKit with the dnf5 backend are affected; other backends honor the simulate flag. No public proof of concept is known, the flaw is not on the CISA KEV list, and there is no indication of exploitation in the wild.

What to do: Apply your distribution's PackageKit security update as soon as it is released (Fedora and RHEL 10 family advisories) and confirm the patched build is installed. Until then, restrict unprivileged local shell accounts on hosts where PackageKit uses the dnf5 backend (verify with 'pkcon backend-detail'), and review dnf history, PackageKit transaction logs, and journald entries for unexpected package removals by non-admin users.