CVE-2026-41651

CVE Enrichment

CVSS: 8.8 HIGH
EPSS: 0.46%
EPSS Percentile: 38.53%
CISA KEV: Not listed

Description

PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: 1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction has already been authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING. 2. Silent state-transition rejection (lines 873–882): `pk_transaction_set_state()` silently discards backward state transitions (e.g. `RUNNING` → `WAITING_FOR_AUTH`) but the flag overwrite at step 1 already happened. The transaction continues running with corrupted flags. 3. Late flag read at execution time (lines 2273–2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at authorization time. If flags were overwritten between authorization and execution, the backend sees the attacker's flags.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: security-advisories@github.com
Published: 22-Apr-2026 21:17
Last Modified: 15-Jul-2026 09:21
EPSS Date: 2026-10-20
CWE: CWE-367

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

packagekit_project / packagekit
Version / affected range: * · from (inclusive) 1.0.2 · before (exclusive) 1.3.5
cpe:2.3:a:packagekit_project:packagekit:*:*:*:*:*:*:*:*

References

Last enrichment sync: 21-Oct-2026 15:19
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Pack2TheRoot CVE-2026-41651 vulnerability (CVSS 8.8 High) 16% of the time. The macOS Sequoia Picus Blue Report 2026 Finds Enterprise Defenses Block Just 37% of Post-Compromise Actions

CVE (9)

Malware (10)

Threat Actors (10)

MITRE ATT&CK (15)

Vendors (1)

Products (16)

Tools (3)

Industries (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.