CVE-2026-41651 PackageKit CVE debrief

Who should care

System administrators and users of PackageKit-based systems should be aware of this vulnerability and take immediate action to patch vulnerable systems. This vulnerability can be exploited by a local unprivileged user, making it a significant concern for multi-user systems. Red Hat and other affected vendors have released errata and patches to address this issue.

Technical summary

The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: unconditional flag overwrite, silent state-transition rejection, and late flag read at execution time. The unconditional flag overwrite writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction has already been authorized/started. The silent state-transition rejection silently discards backward state transitions but leaves corrupted flags in place. The late flag read at execution time reads cached_transaction_flags at dispatch time, not at authorization time.

Defensive priority

High priority should be given to patching vulnerable systems, as this vulnerability can be exploited by a local unprivileged user to gain root privileges. System administrators should apply patches or updates as soon as possible to prevent exploitation.

Recommended defensive actions

• Apply patches or updates to PackageKit as soon as possible to prevent exploitation.
• Review system logs for suspicious activity related to PackageKit transactions.
• Implement additional monitoring and logging to detect potential exploitation attempts.
• Restrict access to PackageKit and related services to authorized users only.
• Consider implementing compensating controls, such as SELinux or other mandatory access control mechanisms, to limit the impact of a potential exploit.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, its impact, and affected versions. The source item URL provides additional information on the vulnerability and its exploitation. Red Hat and other affected vendors have released errata and patches to address this issue.

Official resources