CVE-2026-41651
TOCTOU Race Condition in PackageKit Allows Local Root Installation
Publication date: 2026-04-22
Last updated on: 2026-05-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| packagekit_project | packagekit | From 1.0.2 (inc) to 1.3.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-367 | The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in PackageKit versions 1.0.2 through 1.3.4 and is a time-of-check time-of-use (TOCTOU) race condition involving transaction flags. It allows an unprivileged local user to install arbitrary RPM packages as root without authentication.
The issue arises because the software overwrites transaction flags without proper checks, silently rejects backward state transitions while leaving corrupted flags in place, and reads these corrupted flags at execution time instead of authorization time. This combination enables an attacker to escalate privileges locally by installing packages with root permissions.
How can this vulnerability impact me? :
This vulnerability can lead to local privilege escalation, allowing an unprivileged user to gain root access on the affected system.
An attacker exploiting this flaw can install arbitrary RPM packages as root, including executing malicious RPM scriptlets, which can compromise the entire system's security and integrity.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade PackageKit to version 1.3.5 or later, where the issue is patched.
Until the upgrade is applied, restrict unprivileged user access to PackageKit to prevent exploitation of the local privilege escalation vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-41651 is a high-severity local privilege escalation vulnerability that allows unprivileged users to gain root access and install arbitrary packages without authentication. This results in a full loss of confidentiality, integrity, and availability of the affected system.
Such a compromise can severely impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over access to sensitive data and system integrity. Unauthorized root access could lead to data breaches, unauthorized data modification, and disruption of services, all of which violate these regulatory requirements.
Therefore, organizations using vulnerable versions of PackageKit (1.0.2 through 1.3.4) risk non-compliance due to potential unauthorized access and control over protected data and systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect the vulnerability by checking the installed PackageKit version and verifying if the PackageKit daemon is active on your system.
- Check the installed PackageKit version using package manager commands such as:
- `dpkg -l | grep -i packagekit` (for Debian/Ubuntu systems)
- `rpm -qa | grep -i packagekit` (for RPM-based systems like Fedora, RHEL)
- Check if the PackageKit daemon is running with commands like:
- `systemctl status packagekit`
- or
- `pkmon`
Additionally, monitoring system logs for PackageKit daemon crashes or assertion failures can indicate exploitation attempts. Look for log entries similar to:
- PackageKit:ERROR:../src/pk-transaction.c:514:pk_transaction_finished_emit: assertion failed: (!transaction->priv->emitted_finished) Bail out!
Systemd may automatically restart the daemon after such crashes, so repeated crashes or restarts in logs are a forensic indicator of compromise.