diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index fd9f0003bd7..01a5b7839ca 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -107,6 +107,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 
 *Auditbeat*
 
+- Fix segfaults that may happen if user runs multiple instances of the package metricset {pull}40525[40525]
 
 
 *Filebeat*
diff --git a/x-pack/auditbeat/module/system/package/rpm_linux.go b/x-pack/auditbeat/module/system/package/rpm_linux.go
index 75384ffe7f6..7a4b8c6ca8a 100644
--- a/x-pack/auditbeat/module/system/package/rpm_linux.go
+++ b/x-pack/auditbeat/module/system/package/rpm_linux.go
@@ -12,6 +12,7 @@ import (
 	"fmt"
 	"runtime"
 	"strings"
+	"sync"
 	"time"
 	"unsafe"
 
@@ -178,9 +179,12 @@ const (
 )
 
 var openedLibrpm *librpm
+var librpmLock sync.Mutex
 
 // closeDataset performs cleanup when the dataset is closed.
 func closeDataset() error {
+	librpmLock.Lock()
+	defer librpmLock.Unlock()
 	if openedLibrpm != nil {
 		err := openedLibrpm.close()
 		openedLibrpm = nil
@@ -341,6 +345,8 @@ func openLibrpm() (*librpm, error) {
 }
 
 func listRPMPackages(ownsThread bool) ([]*Package, error) {
+	librpmLock.Lock()
+	defer librpmLock.Unlock()
 	// In newer versions, librpm is using the thread-local variable
 	// `disableInterruptSafety` in rpmio/rpmsq.c to disable signal
 	// traps. To make sure our settings remain in effect throughout
@@ -398,7 +404,6 @@ func listRPMPackages(ownsThread bool) ([]*Package, error) {
 
 		packages = append(packages, pkg)
 	}
-
 	return packages, nil
 }