Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2026-41651 EUVD-2026-24742

PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root

Published Apr 22, 2026 · Updated Jul 15, 2026 · Assigned by GitHub_M

Vendor: PackageKit Product: PackageKit Package: packagekit Package: packagekit Ecosystem: Debian Ecosystem: Ubuntu

Description

PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5.

A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`:
1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction has already been authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING.
2. Silent state-transition rejection (lines 873–882): `pk_transaction_set_state()` silently discards backward state transitions (e.g. `RUNNING` → `WAITING_FOR_AUTH`) but the flag overwrite at step 1 already happened. The transaction continues running with corrupted flags.
3. Late flag read at execution time (lines 2273–2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at authorization time. If flags were overwritten between authorization and execution, the backend sees the attacker's flags.

Affected products

VendorProductAffectedFixed
PackageKit PackageKit >= 1.0.2, <= 1.3.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 packagekit 1.3.5-1 —
Debian 13 packagekit 1.3.1-1+deb13u1 —
Debian 12 packagekit 1.2.6-5+deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS packagekit 1.3.4-3ubuntu1 —
Ubuntu 25.10 packagekit 1.3.1-1ubuntu1.1 —
Ubuntu 24.04 LTS packagekit 1.2.8-2ubuntu1.5 —
Ubuntu 22.04 LTS packagekit 1.2.5-2ubuntu3.1 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS packagekit 1.1.13-2ubuntu1.1+esm1 —
Ubuntu Pro 18.04 LTS packagekit 1.1.9-1ubuntu2.18.04.6+esm1 —
Ubuntu Pro 16.04 LTS packagekit 0.8.17-4ubuntu6~gcc5.4ubuntu1.5+esm1 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 PackageKit +5 1.2.8-8.el10_2 RHSA-2026:19141
RHEL 9 PackageKit +5 1.2.6-2.el9_7 RHSA-2026:19354, RHSA-2026:11504
RHEL 8 PackageKit +6 1.1.12-8.el8_10 RHSA-2026:11635
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS PackageKit +5 1.2.8-8.el10_0.1 RHSA-2026:19601
RHEL 9.6 EUS PackageKit +5 1.2.6-1.el9_6.1 RHSA-2026:18031
RHEL 9.4 EUS PackageKit +5 1.2.6-1.el9_4.1 RHSA-2026:19454
RHEL 9.2 E4S PackageKit +4 1.2.4-2.el9_2.1 RHSA-2026:18036
RHEL 9.0 E4S PackageKit +4 1.2.4-2.el9_0.1 RHSA-2026:18024
RHEL 8.8 TUS PackageKit +5 1.1.12-6.el8_8.1 RHSA-2026:17560
RHEL 8.8 E4S PackageKit +5 1.1.12-6.el8_8.1 RHSA-2026:17560
RHEL 8.6 TUS PackageKit +5 1.1.12-6.el8_6.1 RHSA-2026:17561
RHEL 8.6 E4S PackageKit +5 1.1.12-6.el8_6.1 RHSA-2026:17561
RHEL 8.6 AUS PackageKit +5 1.1.12-6.el8_6.1 RHSA-2026:17561
RHEL 8.4 EUS Long Life PackageKit +5 1.1.12-6.el8_4.1 RHSA-2026:17558
RHEL 8.4 AUS PackageKit +5 1.1.12-6.el8_4.1 RHSA-2026:17558
RHEL 7 ELS PackageKit +8 1.1.10-2.el7_9.1 RHSA-2026:22146

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 PackageKit +5 1.2.8-8.el10_2 ALSA-2026:19141
AlmaLinux 9 PackageKit +5 1.2.6-2.el9_7 ALSA-2026:19354, ALSA-2026:11504
AlmaLinux 8 PackageKit +6 1.1.12-8.el8_10 ALSA-2026:11635

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 PackageKit 1.2.8-8.el10 RLSA-2026:19141
Rocky Linux 9 PackageKit 1.2.6-2.el9_7 RLSA-2026:19354, RLSA-2026:11504
Rocky Linux 8 PackageKit 1.1.12-8.el8_10 RLSA-2026:11635

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 PackageKit 1.2.4-150500.6.10.1 SUSE-SU-2026:5144-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 PackageKit 1.2.4-150500.6.10.1 SUSE-SU-2026:5144-1
SLE HPC 15 SP5 PackageKit 1.2.4-150500.6.10.1 SUSE-SU-2026:5144-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed PackageKit 1.3.5-1.1 openSUSE-SU-2026:10629-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 PackageKit +5 1.2.8-2.amzn2023.0.2 ALAS2023-2026-1639
Amazon Linux 2 PackageKit +8 1.1.5-2.amzn2.0.4 ALAS2-2026-3282

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 PackageKit +5 1.2.8-8.0.1.el10_2 ELSA-2026-19141
Oracle Linux 9 PackageKit +5 1.2.6-2.0.1.el9_7 ELSA-2026-19354, ELSA-2026-11504
Oracle Linux 8 PackageKit +6 1.1.12-8.0.1.el8_10 ELSA-2026-11635
Oracle Linux 7 PackageKit +8 1.1.10-2.0.3.el7 ELSA-2026-22146

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 13 repositories · most starred shown

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 31

References