Skip to main content

PackageKit CVE-2026-41651

| EUVDEUVD-2026-24742 HIGH
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2026-04-22 GitHub_M
Privilege Escalation Packagekit
8.8
CVSS 3.1 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Obtain low-privileged local shell
  2. Delivery
    Call PackageKit InstallFiles() with benign flags
  3. Exploit
    Pass PolicyKit authorization check
  4. Install
    Trigger race condition with second InstallFiles() call
  5. C2
    Overwrite cached transaction flags during RUNNING state
  6. Execute
    Silent state rejection leaves corrupted flags
  7. Impact
    Scheduler dispatches with attacker's flags
  8. Step 8
    Install malicious RPM with root scriptlets
  9. Step 9
    Execute arbitrary code as root

Vulnerability Assessment

Weakness
CWE
CWE-367
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
Exploitation Conditions

Requires local authenticated access with low-privileged account (PR:L) on Linux systems running PackageKit versions 1.0.2-1.3.4. Attacker must have ability to invoke D-Bus methods, which is granted by default to local users on standard Linux desktop and server configurations. No special PackageKit configuration required - vulnerability exists in default installation state. Exploitation requires precise timing to win the race condition between two InstallFiles() calls during the authorization-to-execution window, but vendor analysis confirms the race window is practical (AC:L indicates low complexity). Multi-user systems and containerized environments with shared PackageKit instances are at highest risk. Does NOT require: network access (AV:L), user interaction (UI:N), elevated privileges beyond basic local account (PR:L), or non-default configuration. Attack succeeds against default PackageKit deployments on major distributions. Scope change (S:C) indicates exploitation can affect resources beyond PackageKit's privilege boundary, specifically gaining root privileges from low-privileged context.
Impact

Critical real-world risk despite requiring local access. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C) indicates low-privileged local user can reliably exploit without user interaction, with scope change reflecting container/kernel boundary crossing potential. The AC:L (low complexity) rating is accurate - vendor analysis confirms the race window is practical to exploit. While EPSS data is not provided, the combination of detailed exploit analysis in vendor advisory, public POC code references in GitHub commit links, and confirmation from Telekom Security research indicates weaponization likelihood. The privilege escalation from PR:L to root with arbitrary code execution (RPM scriptlet execution) provides complete system compromise. PackageKit is installed by default on major Linux distributions (Fedora, RHEL, Ubuntu, Debian) making exposure widespread. The TOCTOU race is reproducible per vendor's detailed three-bug chain analysis. Primary risk factor: any multi-user Linux system with PackageKit installed allows low-privileged accounts (including compromised containerized services) to escalate to root. Mitigating factor: requires existing local access, limiting remote exploitation to post-compromise scenarios. Confirmation level: vendor-detailed root cause analysis with line-specific code references and released patch version 1.3.5 provide high confidence.
Exploit ScenarioDerived

A local attacker with low-privileged shell access (e.g., compromised web service account, container escape, or legitimate user account) exploits the race condition by calling PackageKit's InstallFiles() D-Bus method twice in rapid succession. First call provides benign transaction flags to pass PolicyKit authorization. During the window between authorization and execution, the attacker issues a second InstallFiles() call with malicious flags (ONLY_TRUSTED=false) that overwrite cached_transaction_flags while the transaction state machine is in RUNNING state. The state machine silently rejects the illegal backward transition but leaves the corrupted flags intact. When the scheduler dispatches the transaction, it reads the attacker's flags and installs a malicious RPM containing root-privileged scriptlets that execute arbitrary code, establish persistence, or exfiltrate data. Public proof-of-concept code implementation details are available in the referenced GitHub commit analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 22, 2026

Local privilege escalation in PackageKit 1.0.2-1.3.4 allows unprivileged Linux users to install arbitrary RPM packages as root without authentication via TOCTOU race condition on transaction flags. The vulnerability exploits three synchronized bugs in the transaction state machine: unconditional flag overwrite, silent state-transition rejection that leaves corrupted flags, and late flag validation at dispatch time. Actively exploited in targeted attacks according to vendor advisory. CVSS 8.8 with scope change reflects full system compromise from low-privileged account. Patched in version 1.3.5.

RemediationAI

Upgrade to PackageKit version 1.3.5 or later, which patches the TOCTOU race condition by fixing the three synchronized bugs in transaction state management. Vendor patch available through standard distribution update channels or from upstream source at https://github.com/PackageKit/PackageKit. For systems unable to immediately upgrade, implement these compensating controls with trade-offs: (1) Restrict D-Bus access to PackageKit's InstallFiles method via D-Bus policy configuration (effect: breaks legitimate package installation workflows for non-root users, may impact GUI package managers). (2) Disable PackageKit service entirely if not required (systemctl mask packagekit) and use distribution-native package managers with direct root authentication (effect: breaks desktop environment integration, automatic update notifications, and cross-platform package management tools). (3) Deploy mandatory access control policies (SELinux/AppArmor) preventing low-privileged processes from invoking PackageKit D-Bus methods (effect: requires custom policy development and testing per distribution). No effective network-layer mitigation exists due to local-only attack vector. Verify patch application by checking installed version: pkcon --version or rpm -q PackageKit (RHEL/Fedora) or dpkg -l packagekit (Debian/Ubuntu).

Affected VersionsENISA

packagekit 1.0.2, ≤ 1.3.4

Affected Packages

euvd packagekit_1_0_2 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

PackageKit is a D-Bus service (cpe:2.3:a:packagekit:packagekit) that provides cross-distribution package management with PolicyKit authorization integration. The vulnerability (CWE-367: Time-of-Check Time-of-Use Race Condition) exists in src/pk-transaction.c where transaction->cached_transaction_flags controls authorization decisions. The flaw involves three interacting code paths: InstallFiles() at line 4036 performs unconditional write to cached flags without checking transaction state; pk_transaction_set_state() at lines 873-882 silently rejects backward state transitions (e.g., RUNNING→WAITING_FOR_AUTH) while leaving the corrupted flags from step one intact; the scheduler's idle callback at lines 2273-2277 reads flags at dispatch time rather than authorization time. This timing window allows an attacker to pass initial PolicyKit authorization with safe flags, then overwrite them with privileged flags during the race between authorization and execution. The D-Bus interface makes the vulnerable InstallFiles() method callable by any local user, and the RPM backend executes package scriptlets as root based on the corrupted flags.

Know when Packagekit gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Apr 29, 2026 - 02:30 nvd
Patch available
CVE Published
Apr 22, 2026 - 13:11 nvd
HIGH 8.8

DescriptionCVE.org

PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5.

A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on transaction->cached_transaction_flags combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in src/pk-transaction.c:

  1. Unconditional flag overwrite (line 4036): InstallFiles() writes caller-supplied flags to transaction->cached_transaction_flags without checking whether the transaction has already been authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING.
  2. Silent state-transition rejection (lines 873-882): pk_transaction_set_state() silently discards backward state transitions (e.g. RUNNING → WAITING_FOR_AUTH) but the flag overwrite at step 1 already happened. The transaction continues running with corrupted flags.
  3. Late flag read at execution time (lines 2273-2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at authorization time. If flags were overwritten between authorization and execution, the backend sees the attacker's flags.

Executive ViewAI

Why It Matters

PackageKit versions 1.0.2 through 1.3.4 contain a local privilege escalation vulnerability that allows unprivileged users to install arbitrary packages as root without authentication, leading to complete system compromise. Linux systems running affected PackageKit versions face immediate risk of lateral movement and persistent compromise by any local user account.

Business Impact: High
Compensating Controls

Vendor-released patch: PackageKit version 1.3.5. If upgrade cannot be completed immediately: restrict PackageKit service access via systemd socket activation or AppArmor/SELinux policies; disable local user shell access for non-essential accounts; implement file integrity monitoring on system package directories (/var/lib/rpm, /usr/lib); monitor PackageKit transaction logs for TOCTOU timing anomalies.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

64
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

More in Packagekit

View all
CVE-2020-16122 HIGH
7.8 Nov 07

PackageKit's apt backend mistakenly treated all local debs as trusted. Rated high severity (CVSS 7.8), this vulnerabilit
CVE-2020-16121 LOW POC
3.3 Nov 07

PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mim
CVE-2026-10294 LOW POC
2.1 Jun 01

Improper authorization in PackageKit up to 1.3.5 allows a low-privileged authenticated remote attacker to bypass access

CVE-2018-1106 MEDIUM
5.5 Apr 23

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privile
CVE-2022-0987 LOW
3.3 Jun 28

A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. Rated
CVE-2013-1764 LOW
2.1 Apr 16

The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages via the "install updat
CVE-2024-0217 LOW
3.3 Jan 03

A use-after-free flaw was found in PackageKitd. Rated low severity (CVSS 3.3), this vulnerability is low attack complexi

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2023-35311 HIGH
8.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/358852 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1619/ REF http://www.openwall.com/lists/oss-security/2026/04/22/6 REF https://access.redhat.com/errata/RHSA-2026:11504 REF https://access.redhat.com/errata/RHSA-2026:11635 REF https://access.redhat.com/errata/RHSA-2026:17558 REF https://access.redhat.com/errata/RHSA-2026:17560 REF https://access.redhat.com/errata/RHSA-2026:17561 REF https://access.redhat.com/errata/RHSA-2026:18024 REF https://access.redhat.com/errata/RHSA-2026:18031 REF https://access.redhat.com/errata/RHSA-2026:18036 REF https://access.redhat.com/errata/RHSA-2026:19141 REF https://access.redhat.com/errata/RHSA-2026:19354 REF https://access.redhat.com/errata/RHSA-2026:19454 REF https://access.redhat.com/errata/RHSA-2026:19601 REF https://access.redhat.com/errata/RHSA-2026:22146 REF https://access.redhat.com/security/cve/CVE-2026-41651 REF https://bugzilla.redhat.com/show_bug.cgi?id=2460604 REF https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L2273-L2277 REF https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L4036 REF https://github.com/PackageKit/PackageKit/blob/04057883189efa225a7c785591aa87cb299782f8/src/pk-transaction.c#L873-L882 REF https://github.com/PackageKit/PackageKit/security/advisories/GHSA-f55j-vvr9-69xv REF https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41651.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy