diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 2941561c950a..15267091be54 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -79,6 +79,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 
 *Auditbeat*
 
+- Fix segfaults that may happen if user runs multiple instances of the package metricset {pull}40525[40525]
 
 
 *Filebeat*
diff --git a/x-pack/auditbeat/module/system/package/rpm_linux.go b/x-pack/auditbeat/module/system/package/rpm_linux.go
index e2b7489675de..d8f6adb716ce 100644
--- a/x-pack/auditbeat/module/system/package/rpm_linux.go
+++ b/x-pack/auditbeat/module/system/package/rpm_linux.go
@@ -12,6 +12,7 @@ import (
 	"fmt"
 	"runtime"
 	"strings"
+	"sync"
 	"time"
 	"unsafe"
 
@@ -168,9 +169,12 @@ const (
 )
 
 var openedLibrpm *librpm
+var librpmLock sync.Mutex
 
 // closeDataset performs cleanup when the dataset is closed.
 func closeDataset() error {
+	librpmLock.Lock()
+	defer librpmLock.Unlock()
 	if openedLibrpm != nil {
 		err := openedLibrpm.close()
 		openedLibrpm = nil
@@ -325,6 +329,8 @@ func openLibrpm() (*librpm, error) {
 }
 
 func listRPMPackages() ([]*Package, error) {
+	librpmLock.Lock()
+	defer librpmLock.Unlock()
 	// In newer versions, librpm is using the thread-local variable
 	// `disableInterruptSafety` in rpmio/rpmsq.c to disable signal
 	// traps. To make sure our settings remain in effect throughout
@@ -376,7 +382,6 @@ func listRPMPackages() ([]*Package, error) {
 
 		packages = append(packages, pkg)
 	}
-
 	return packages, nil
 }