CVE-2026-41651 - Vulnerability Analysis

Overview

PackageKit 1.0.2 to 1.3.4 contains a local privilege escalation caused by a TOCTOU race condition on transaction flags in pk-transaction.c, letting unprivileged users install packages as root, exploit requires local access.

Severity & Score

Impact

Local unprivileged users can install arbitrary packages as root, leading to full system compromise.

Mitigation

Upgrade to version 1.3.5 or later.

References

• https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L2273-L2277
• https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L4036
• https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L873-L882
• https://github.com/PackageKit/PackageKit/security/advisories/GHSA-f55j-vvr9-69xv
• https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html
• http://www.openwall.com/lists/oss-security/2026/04/22/6

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner