CVE-2026-41651 PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root

What is CVE-2026-41651?

CVE-2026-41651 is a high-severity vulnerability in PackageKit, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5.

A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: 1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction has already been authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING. 2. Silent state-transition rejection (lines 873–882): `pk_transaction_set_state()` silently discards backward state transitions (e.g. `RUNNING` → `WAITING_FOR_AUTH`) but the flag overwrite at step 1 already happened. The transaction continues running with corrupted flags. 3. Late flag read at execution time (lines 2273–2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at authorization time. If flags were overwritten between authorization and execution, the backend sees the attacker's flags.

Weakness: CWE-367

Which versions are affected by CVE-2026-41651?

It affects 1 product.

Products include Packagekit Project Packagekit.

How do I fix CVE-2026-41651?

Upgrade to a fixed version.

Is CVE-2026-41651 being exploited?

There is no known exploitation of CVE-2026-41651 in the wild and no public exploit code.

Public exploit code: 12 proofs of concept on GitHub.

Other vulnerabilities in PackageKit

• CVE-2022-0987 Information disclosure in PackageKit Low 3.3
• CVE-2013-1764 Privilege escalation in n/a Low 2.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALSA-2026:11504, ALSA-2026:11635, ALSA-2026:19141, ALSA-2026:19354, CLSA-2026-1778773906, CLSA-2026-1779711412 and 32 more.