CVE-2026-104619: PackageKit ZYpp rollback vulnerability
Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PackageKit Zypp Backendto a version that resolves this vulnerability.Fixed in 1.4.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A local untrusted user with low privileges can exploit it on systems using the PackageKit Zypp Backend before version 1.4.1. No user interaction is required.
What is the potential impact?
An attacker could roll back security updates and use that ability to escalate privileges. The affected security properties include confidentiality, integrity, and availability.
How can I determine whether a system is affected?
Check whether the system uses the PackageKit Zypp Backend and whether its version is earlier than 1.4.1. Systems on version 1.4.1 or later are not identified as affected by the provided information.