CVE-2026-41651: PackageKit Privilege Escalation Flaw

CVE-2026-41651 Overview

CVE-2026-41651 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in PackageKit, a D-Bus abstraction layer that allows users to manage packages in a secure way using a cross-distro, cross-architecture API. This vulnerability affects PackageKit versions 1.0.2 through 1.3.4 and enables unprivileged local users to install arbitrary packages as root, resulting in local privilege escalation.

The vulnerability stems from improper handling of transaction flags in the PackageKit daemon. A local attacker can exploit this race condition to install arbitrary RPM packages with root privileges, including executing RPM scriptlets, all without authentication. This effectively allows complete system compromise from an unprivileged local account.

Critical Impact

Local unprivileged users can escalate to root privileges by installing arbitrary packages without authentication, enabling complete system compromise on affected Linux systems.

Affected Products

• PackageKit versions 1.0.2 through 1.3.4
• Linux distributions using vulnerable PackageKit versions for package management
• Systems with D-Bus enabled and PackageKit daemon running

Discovery Timeline

• April 22, 2026 - CVE-2026-41651 published to NVD
• April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-41651

Vulnerability Analysis

This vulnerability is a classic time-of-check time-of-use (TOCTOU) race condition affecting the transaction flag handling in PackageKit's core transaction processing code. The flaw allows an attacker to manipulate transaction flags between the authorization check and the actual execution of privileged operations.

The vulnerability chain consists of three interconnected bugs in src/pk-transaction.c:

1. Unconditional flag overwrite (line 4036): The InstallFiles() function writes caller-supplied flags to transaction->cached_transaction_flags without verifying whether the transaction has already been authorized or started. A second call can blindly overwrite the flags even while the transaction is in RUNNING state.

2. Silent state-transition rejection (lines 873–882): The pk_transaction_set_state() function silently discards backward state transitions (such as RUNNING → WAITING_FOR_AUTH), but the flag overwrite from step 1 has already occurred. The transaction continues running with corrupted flags.

3. Late flag read at execution time (lines 2273–2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time rather than at authorization time. If flags were overwritten between authorization and execution, the backend processes the attacker's malicious flags.

This combination allows an unprivileged user to bypass authentication requirements and execute package installation operations with root privileges.

Root Cause

The root cause is improper synchronization and validation of transaction state and flags in PackageKit's D-Bus transaction handling. The code fails to implement proper locking or atomic operations when modifying transaction flags, and does not validate flag integrity at execution time. The silent discarding of invalid state transitions masks the corruption, allowing the race condition to succeed without generating errors that would alert administrators.

Attack Vector

The attack requires local access to the target system. An unprivileged user initiates a legitimate package transaction that requires authentication, then exploits the race window to overwrite the transaction flags before the authorized operation executes. By winning this race, the attacker can modify flags to bypass security checks, ultimately installing arbitrary RPM packages with root privileges.

The attack flow involves:

1. Starting a transaction that enters the authorization workflow
2. Timing a second call to InstallFiles() to overwrite cached_transaction_flags
3. Exploiting the silent state rejection to keep corrupted flags in place
4. Having the scheduler execute the operation with attacker-controlled flags

Technical details of the vulnerable code sections can be found in the PackageKit source code references and the GitHub Security Advisory.

Detection Methods for CVE-2026-41651

Indicators of Compromise

• Unexpected package installations in system logs without corresponding administrator actions
• Unusual D-Bus activity involving PackageKit transactions from non-administrative users
• RPM scriptlet execution evidence in logs without legitimate package management operations
• Anomalous privilege elevation patterns in audit logs involving the packagekitd process

Detection Strategies

• Monitor D-Bus message traffic to PackageKit for unusual transaction flag patterns or rapid successive InstallFiles() calls
• Implement audit rules for package installation events and correlate with authenticated user sessions
• Deploy endpoint detection solutions capable of identifying TOCTOU exploitation patterns in process behavior
• Enable comprehensive logging for the PackageKit daemon and analyze for authorization bypass indicators

Monitoring Recommendations

• Configure auditd rules to track executions of packagekitd and related package management processes
• Establish baseline package installation patterns and alert on deviations from non-privileged accounts
• Monitor for rapid state transitions in PackageKit transaction logs that may indicate race condition exploitation
• Implement real-time alerting for any package installation attempts from unprivileged user contexts

How to Mitigate CVE-2026-41651

Immediate Actions Required

• Upgrade PackageKit to version 1.3.5 or later, which contains the security patch for this vulnerability
• Restrict local user access on critical systems until patching is complete
• Review system logs for any indicators of prior exploitation attempts
• Consider temporarily disabling PackageKit on high-value systems if immediate patching is not feasible

Patch Information

PackageKit version 1.3.5 addresses this vulnerability by implementing proper synchronization of transaction flag handling and ensuring flags are validated at execution time rather than only at authorization time. Organizations should prioritize upgrading to this version or later.

For detailed patch information, refer to the GitHub Security Advisory and the Telekom Security Analysis.

Workarounds

• Disable the PackageKit daemon service (systemctl stop packagekit && systemctl disable packagekit) on systems where GUI-based package management is not required
• Implement restrictive PolicyKit rules to require stronger authentication for package operations
• Use application control solutions to restrict which packages can be installed on production systems
• Limit local user access to critical infrastructure systems until patches can be applied

# Disable PackageKit service as temporary mitigation
sudo systemctl stop packagekit
sudo systemctl disable packagekit

# Verify service is stopped
sudo systemctl status packagekit