PackageKit Vulnerability Allows Local Privilege Escalation via TOCTOU Exploit

The National Vulnerability Database has detailed CVE-2026-41651, a critical vulnerability in PackageKit versions 1.0.2 through 1.3.4. This flaw stems from a time-of-check to time-of-use (TOCTOU) race condition affecting transaction flags. It allows unprivileged local users to install arbitrary RPM packages, including executing root-level scriptlets, by manipulating flags during the transaction process. This bypasses authentication and effectively grants root privileges.

The exploit exploits a flaw in how PackageKit handles transaction flags. Specifically, InstallFiles() unconditionally overwrites flags, even after authorization. A subsequent silent rejection of backward state transitions leaves corrupted flags in place. The scheduler then reads these manipulated flags at execution time, allowing the attacker’s arbitrary package installation to proceed as root. The National Vulnerability Database assigns this a CVSS score of 8.8 (HIGH).

Defenders should prioritize patching PackageKit to version 1.3.5 immediately. For systems that cannot be patched promptly, heightened monitoring for anomalous package installation activity and suspicious RPM scriptlet execution is crucial. Understanding the TOCTOU exploit vector is key for detecting exploitation attempts.