PT-2026-34331 · Unknown · Packagekit

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-41651

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PackageKit versions 1.0.2 through 1.3.4

Description PackageKit contains a time-of-check time-of-use (TOCTOU) race condition involving transaction flags. This issue allows an unprivileged local user to install arbitrary RPM packages as root without authentication, including the execution of RPM scriptlets, leading to local privilege escalation. The flaw stems from three bugs in src/pk-transaction.c: the InstallFiles() function overwrites transaction->cached transaction flags without verifying if the transaction is already authorized or running; the pk transaction set state() function silently rejects backward state transitions while leaving corrupted flags intact; and the scheduler's idle callback reads cached transaction flags at dispatch time rather than authorization time.

Recommendations Update to version 1.3.5.

Exploit

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-41651

Affected Products

Packagekit

References · 9

• 🔥 https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41651 · Security Note
• https://github.com/PackageKit/PackageKit/security/advisories/GHSA-f55j-vvr9-69xv · Note
• https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L873-L882 · Note
• https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L2273-L2277 · Note
• https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L4036 · Note
• http://openwall.com/lists/oss-security/2026/04/22/6 · Note
• https://twitter.com/lazy_daemon/status/2046966423994466573 · Twitter Post
• https://twitter.com/CVEnew/status/2047012145473409343 · Twitter Post