CVE-2026-41651 - Vulnerability Analysis
HighCVSS: 8.8Last Updated: April 24, 2026
PackageKit - Privilege Escalation
Overview
PackageKit 1.0.2 to 1.3.4 contains a local privilege escalation caused by a TOCTOU race condition on transaction flags in pk-transaction.c, letting unprivileged users install packages as root, exploit requires local access.
Severity & Score
Impact
Local unprivileged users can install arbitrary packages as root, leading to full system compromise.
Mitigation
Upgrade to version 1.3.5 or later.
References
- http://www.openwall.com/lists/oss-security/2026/04/22/6
- https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L2273-L2277
- https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L4036
- https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L873-L882
- https://github.com/PackageKit/PackageKit/security/advisories/GHSA-f55j-vvr9-69xv
- https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html
Social Media Activity(8 posts)
🚨 CVE-2026-41651 (Pack2TheRoot) PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. ℹ️ Additional info on ZEN SecDB https://secdb.nttzen.cloud/cve/detail/CVE-2026-41651 #nttdata #zen #secdb #infosec #pack2theroot #cve2026411651 #packagekit #toctou
View original post
Pack2TheRoot (CVE-2026-41651): Cross-Distro Local Privilege Escalation Vulnerability https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html Read on HackerWorkspace: https://hackerworkspace.com/article/pack2theroot-cve-2026-41651-cross-distro-local-privilege-escalation-vulnerability #cybersecurity #vulnerability #exploit
View original post
🚨 CVE-2026-41651 (Pack2TheRoot) PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. ℹ️ Additional info on ZEN SecDB https://secdb.nttzen.cloud/cve/detail/CVE-2026-41651 #nttdata #zen #secdb #infosec #pack2theroot #cve2026411651 #packagekit #toctou
View original post
12-year-old Pack2TheRoot bug lets Linux users gain root privileges ‘Pack2TheRoot’ flaw lets local Linux users gain root via PackageKit. CVE-2026-41651 (8.8) has existed for nearly 12 years. The... https://mastodon.social/tags/Hacking https://mastodon.social/tags/Security https://mastodon.social/tags/CVE-2026-41651 https://mastodon.social/tags/hacking https://mastodon.social/tags/news https://mastodon.social/tags/information https://mastodon.social/tags/security https://mastodon.social/tags/news https://mastodon.social/tags/IT https://mastodon.social/tags/Information https://mastodon.social/tags/Security https://securityaffairs.com/191231/security/12-year-old-pack2theroot-bug-lets-linux-users-gain-root-privileges.html | https://awakari.com/sub-details.html?id=linux | https://awakari.com/pub-msg.html?id=E2WVLtWFoMKeXFeOPWMKbgs1RY0&interestId=linux
View original post
Pack2TheRoot (CVE-2026-41651): Cross-Distro Local Privilege Escalation Vulnerability https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html Read on HackerWorkspace: https://hackerworkspace.com/article/pack2theroot-cve-2026-41651-cross-distro-local-privilege-escalation-vulnerability #cybersecurity #vulnerability #exploit
View original post
Here's a harmless little #PoC for the #PackageKit LPE vulnerability (CVE-2026-41651), by @br3zel and myself: https://codeberg.org/hillu/cve-2026-41651-poc It was a lot of fun to piece together.
View original post
📢 CVE-2026-41651 : Élévation de privilèges locale cross-distro via PackageKit (Pack2TheRoot) 📝 ## 🔍 Contexte Publié le 22 avril 2026 par l'équipe Red Team de Deutsche Telekom sur leur blog séc... 📖 cyberveille : https://cyberveille.ch/posts/2026-04-23-cve-2026-41651-elevation-de-privileges-locale-cross-distro-via-packagekit-pack2theroot/ 🌐 source : https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html #CVE_2026_41651 #IOC #Cyberveille
View original post
Pack2TheRoot (CVE-2026-41651): Cross-Distro Local Privilege Escalation Vulnerability https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html
View original postGitHub Repositories(5 repos)
Related Resources
Details
- CVE ID
- CVE-2026-41651
- Severity
- High
- CVSS Score
- 8.8
- Type
- race_condition
- Status
- confirmed
- EPSS
- 2.5%
- Social Posts
- 8
CWE
- CWE-367
CVSS Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H