Exploitation observed; activity peaked at 14 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: 1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction has already been authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING. 2. Silent state-transition rejection (lines 873–882): `pk_transaction_set_state()` silently discards backward state transitions (e.g. `RUNNING` → `WAITING_FOR_AUTH`) but the flag overwrite at step 1 already happened. The transaction continues running with corrupted flags. 3. Late flag read at execution time (lines 2273–2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at authorization time. If flags were overwritten between authorization and execution, the backend sees the attacker's flags.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-22 | 6 | Disclosure4Patch1PoC1 |
| 2026-04-23 | 8 | Disclosure3Exploit1Patch1PoC3 |
| 2026-04-24 | 10 | Disclosure5General1Patch3PoC1 |
| 2026-04-25 | 9 | Disclosure3Exploit2General1Patch3 |
| 2026-04-26 | 2 | Disclosure1Exploit1 |
| 2026-04-27 | 14 | Active Exploitation1Disclosure9General3Patch1 |
| 2026-04-28 | 4 | Disclosure2Patch1PoC1 |
| 2026-04-29 | 1 | Disclosure1 |
| 2026-05-01 | 1 | General1 |
| 2026-05-04 | 1 | Patch1 |
| 2026-05-05 | 2 | Disclosure1Patch1 |
| 2026-05-06 | 1 | PoC1 |
| 2026-05-07 | 1 | Disclosure1 |
| 2026-05-14 | 1 | General1 |
| 2026-05-18 | 2 | Disclosure1General1 |
| 2026-05-19 | 1 | Patch1 |
| 2026-05-22 | 2 | Disclosure2 |
| 2026-05-26 | 1 | Exploit1 |
| 2026-06-04 | 1 | Disclosure1 |
| 2026-06-15 | 1 | Disclosure1 |
| 2026-06-16 | 1 | Exploit1 |
| 2026-06-26 | 1 | General1 |
| 2026-07-02 | 1 | Disclosure1 |
| 2026-09-10 | 1 | Active Exploitation1 |
I just POC Pack2TheRoot (CVE-2026-41651) : - https://github.com/Vozec/CVE-2026-41651 Local Privilege Escalation in PackageKit discovered by http://telekom.com affecting Ubuntu/Debian/RockyLinux/Fedora https://t.co/VlJKf9Y9LH
Post summary
The tweet shares a proof‑of‑concept for CVE-2026-41651, revealing a local privilege escalation flaw in PackageKit across multiple Linux distributions.
Privilege Escalation: Getting Started with the Pack2TheRoot (CVE-2026-41651) Vulnerability to Escalate Privileges In this article, we will explore how this vulnerability appears, how it can be exploited, and how you can defend against it. https://hackers-arise.com/privilege-escalation-getting-started-with-the-pack2theroot-cve-2026-41651-vulnerability-to-escalate-privileges/ @three_cube https://t.co/e8M6qAat7n
Post summary
The blog post offers a high‑level overview of CVE‑2026‑41651, outlining potential exploitation and general defense strategies, but it lacks detailed technical data, PoC links, or evidence of active attacks.
🚨 Nueva vulnerabilidad crítica en Linux El fallo Pack2TheRoot (CVE-2026-41651) afecta a PackageKit y permite a usuarios locales obtener permisos root. 👉 Presente desde 2014 en múltiples distros (Ubuntu, Debian, Fedora, RockyLinux). https://t.co/8JQ1p3J8ep
Post summary
A new local privilege escalation vulnerability (CVE‑2026‑41651) in PackageKit allows local users to gain root access, and has been present since 2014 across multiple Linux distributions.
⚠️ Pack2TheRoot Vulnerability Let Attackers Gain Root Access or Compromise the System Source: https://cybersecuritynews.com/pack2theroot-vulnerability/ A high-severity privilege escalation vulnerability, dubbed Pack2TheRoot (CVE-2026-41651, CVSS 3.1: 8.8), has been publicly disclosed. The flaw allows any local unprivileged user to silently install or remove system packages, ultimately achieving full root access without requiring a password. The vulnerability resides in the PackageKit daemon, a widely deployed cross-distribution package management abstraction layer used across Debian, Ubuntu, Fedora, and Red Hat-based systems. Exploiting this flaw, an attacker with basic local access can bypass authorization controls entirely, installing malicious packages or removing critical security components to compromise the system. #cybersecuritynews #Linux
Post summary
The article announces CVE‑2026‑41651, a high‑severity privilege escalation flaw in PackageKit that lets local users gain root access, yet it offers no PoC, exploit code, evidence of active exploitation, or patch information.
Privilege Escalation: Exploiting Pack2TheRoot (CVE-2026-41651) See how a trusted package check can be turned into a privilege escalation path by replacing it with a malicious payload at the perfect moment. https://hackers-arise.com/privilege-escalation-getting-started-with-the-pack2theroot-cve-2026-41651-vulnerability-to-escalate-privileges/ @three_cube @DI0256 https://t.co/YJzuz4WHkm
Post summary
The post demonstrates how to exploit a privileged escalation via Pack2TheRoot by swapping a trusted package check with malware, linking to a blog that likely contains a PoC, but it does not mention active exploitation, patches, or a playback of an exploit tool.
Recent TOCTOU vulnerability in PackageKit allows attackers to escalate privileges to root. The vulnerability, Pack2TheRoot (CVE-2026-41651), is analyzed by our colleague Vadim, who also explains how to protect yourself. Read more: https://purpleshift.io/purple/2026-06-09-rsgr/ https://t.co/9Jl9gEDTgt
Post summary
A brief announcement of a new TOCTOU privilege‑escalation vulnerability in PackageKit (CVE‑2026‑41651) with a link to a discussion that offers protection advice, but no exploit code or patch details are provided.
Getting Started with the Pack2TheRoot (CVE-2026-41651) Vulnerability to Escalate Privileges Pack2TheRoot is a security flaw that allows unprivileged users to gain full root access on Linux systems via the PackageKit service. Details below: https://hackers-arise.com/privilege-escalation-getting-started-with-the-pack2theroot-cve-2026-41651-vulnerability-to-escalate-privileges/ @three_cube https://t.co/If5wTpMua8
Post summary
The tweet introduces the Pack2TheRoot flaw (CVE‑2026‑41651), noting that it allows unauthenticated users to gain root access through the PackageKit service. No PoC, exploit code, active exploitation, or patch information is provided.
Apparently, one of our test servers was compromised through CVE-2026-41651, a React 2 shell that gave the attacker a reverse shell. At first, it looked like a straightforward compromise. Then we found a reverse shell running as forge since Aug 7, connecting to 77.93.153.91:8080. The forge account was already authorized for unrestricted, passwordless sudo via the server's sudoers configuration. The attacker leveraged that existing privilege to escalate from forge to root with sudo su just 11 minutes later. That root shell is still alive. Then it got more interesting. A root implant, /usr/bin/defaults, had been running since Aug 8, disguised as [php-fpm], with an outbound connection to 167.71.214.178:443. It persisted through server-security.service with Restart=always and was enabled at boot. And our diagnostic tools were lying to us. The attacker had replaced ps, lsof, and netstat with wrappers that filtered their own processes from the output. .bash_history was also wiped. They even modified PHP's disable_functions shortly after installing the root implant to prevent other attackers and webshells from gaining a control. The server was isolated, and fortunately it was a VM. So rather than trust a compromised system, we rebuilt it from a clean image. The persistence and level of stealth were honestly impressive.
Post summary
A test server was compromised via CVE‑2026‑41651, enabling a reverse shell and subsequent stealthy root persistence. The post documents a concrete, active exploitation incident rather than a simple disclosure or patch notice.
🚨 Our Red Team discovered a new Linux vulnerability: “Pack2TheRoot” (CVE-2026-41651) It affects PackageKit versions 1.0.2–1.3.4 across major distros like Ubuntu, Debian, Fedora & Rocky Linux -potentially impacting servers running Cockpit. Details 👇https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html
Post summary
A Red Team has disclosed CVE-2026-41651, a local privilege escalation flaw in PackageKit versions 1.0.2–1.3.4 affecting multiple Linux distributions, with detailed information linked for further review.
Pack2TheRoot - CVE-2026-41651 TOCTOU race in PackageKit's transaction handler. Any local unprivileged user can install arbitrary packages as root with no authentication If your system has PackageKit (which almost every modern Ubuntu/Fedora/Debian desktop and many servers do) it’s vulnerable out of the box Repo: https://github.com/Vozec/CVE-2026-41651 Research: https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html #cybersecurity #linux
Post summary
CVE‑2026‑41651 is a local privilege‑escalation vulnerability in PackageKit, now publicly documented with a functional PoC that allows unprivileged users to install packages as root without authentication.
🚨Claude Opus اكتشف ثغرة عمرها 12 سنة في انظمه لينكس الثغرة في (PackageKit) وتعطي المهاجم صلاحيات Root على النظام. رقم الثغرة: CVE-2026-41651 | التقييم: 8.8 (High). التفاصيل التقنية في التغريدات التالية : 🧵👇
Post summary
The tweet announces a 12‑year‑old vulnerability in PackageKit that grants attackers root access, providing the CVE ID and severity score but no evidence of exploitation or mitigation.
This is what happens when you give our Red Team a bit of free time to do some research.. #CVE-2026-41651 https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html
Post summary
The post highlights that the Red Team has released a proof‑of‑concept for CVE‑2026‑41651, with a link presumably containing the PoC code, but does not include exploitation details, active exploitation reports, or patch information.
🐧 New Linux Privilege Escalation Vulnerability Discovered A newly disclosed vulnerability in PackageKit (CVE-2026-41651) allows local users to gain root privileges under certain conditions. The issue, dubbed “Pack2TheRoot,” affects multiple Linux distributions where PackageKit is enabled by default. Key points: CVSS score: 8.8 (High) Impacts package management operations Can allow unauthorized installation of system packages The flaw reportedly existed for years before being identified and patched. ⚠️ Organizations running Linux systems should ensure PackageKit is updated to the latest version. #CyberSecurity #Linux #Vulnerability #ThreatIntel
Post summary
A new package‑level privilege escalation vulnerability (CVE-2026-41651) is disclosed with a high CVSS score, and organizations are urged to update PackageKit to mitigate the risk.
Privilege Escalation: Getting Started with the Pack2TheRoot (CVE-2026-41651) Vulnerability Recently, we broke down the core mechanics of memory corruption and how you can abuse this vulnerability during cyber operations to take full control of the OS! https://hackers-arise.com/privilege-escalation-getting-started-with-the-pack2theroot-cve-2026-41651-vulnerability-to-escalate-privileges/ @three_cube
Post summary
The article explains how CVE‑2026‑41651 can be abused through memory corruption to gain OS control, but it does not provide a functional exploit, patch, or evidence of in‑the‑wild usage.
Un error de 12 años en Pack2TheRoot permite a usuarios de Linux obtener privilegios de root Un fallo de seguridad llamado Pack2TheRoot , identificado como CVE-2026-41651 (con una puntuación CVSS de 8.8 ) https://blog.elhacker.net/2026/04/un-error-de-12-anos-en-pack2theroot.html
Post summary
Se anuncia el fallo CVE-2026-41651 con CVSS 8.8 que permite elevar privilegios en Linux a través de Pack2TheRoot, sin indicación de explotación activa ni PoC.
CTF-style Docker lab for CVE-2026-41651 - like vulnerabiities (Pack2TheRoot): PackageKit permissive-polkit local privilege escalation (Exploit at docs/solution.md) https://github.com/dinosn/pack2theroot-lab/tree/main
Post summary
The post announces a CTF-style Docker lab for CVE-2026-41651, providing a GitHub repository with exploit code and a solution grid that documents a local privilege escalation through PackageKit's permissive polkit.
Added CVE-2026-41651 (Pack2TheRoot) to lpe-toolkit: https://github.com/portbuster1337/lpe-toolkit/commit/f20945ee2a4cbcc1317dd9e799e18147fadda876
Post summary
The commit adds CVE‑2026‑41651 (Pack2TheRoot) to the lpe-toolkit, indicating that exploit code enabling local privilege escalation is now available.
🚩12-Year-Old PackageKit Flaw Allows Local Users to Gain Root Access https://securityaffairs.com/191231/security/12-year-old-pack2theroot-bug-lets-linux-users-gain-root-privileges.html A 12-year-old PackageKit flaw, now tracked as CVE-2026-41651, can let a local unprivileged Linux user gain root access. The bug, called Pack2TheRoot, affects PackageKit versions 1.0.2 through 1.3.4 and has been seen across multiple distros, including Ubuntu, Debian, Fedora, and Rocky Linux. The fix is in PackageKit 1.3.5, but distro patches may vary. Check if PackageKit is installed on your system and update it if necessary. #Linux #Cybersecurity #InfoSec #PackageKit
Post summary
A long‑existing local privilege‑escalation flaw in PackageKit (CVE‑2026‑41651) allows unprivileged Linux users to gain root. The fix resides in PackageKit 1.3.5, so users should update or apply distro patches.
The critical "Pack2TheRoot" flaw (CVE-2026-41651) in PackageKit gives root access on Linux. It went undetected for 12 years. Update to version 1.3.5 now! #Pack2TheRoot #LinuxSecurity #InfoSec #CyberSecurity #CVE202641651 #RootAccess #TechAlert https://securityonline.info/pack2theroot-packagekit-vulnerability-linux-root-exploit/ https://t.co/MCH13gHBWK
Post summary
The tweet announces a critical root‑access flaw in PackageKit (CVE-2026-41651), urges users to update to version 1.3.5, and includes a link for more details.
GitHub - Vozec/CVE-2026-41651 · GitHub https://github.com/Vozec/CVE-2026-41651
Post summary
The GitHub repository appears to host a PoC for CVE‑2026‑41651; no evidence of active exploitation, patch, or technical details is provided in the text.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | packagekit_project | packagekit | - | - | - |