PackageKit · Public exploit code

PackageKit 1.3.5 Fixes Root Privilege Escalation; Public PoC Out

Nov 04, 2026 · 1 min read

A time-of-check time-of-use race condition in PackageKit transaction flags (CVE-2026-41651, CVSS 8.8) lets a local unprivileged user install arbitrary packages as root, including packages with privileged install scripts. The flaw, dubbed Pack2TheRoot, affects PackageKit 1.0.2 through 1.3.4 on multiple Linux distributions and has a public proof of concept. A fix shipped in PackageKit 1.3.5; update the package on Linux servers and endpoints.

By HIFY Radar newsroom Updated 11/04/2026 08:35 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityPublic exploit codePatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A flaw in the Linux PackageKit package manager lets anyone with local access to a machine, even without permissions, gain full control (root). A public proof of concept exists and a fix is available in PackageKit 1.3.5.

Why it matters

The flaw (CVE-2026-41651, high severity, CVSS 8.8) affects versions 1.0.2 through 1.3.4 on multiple Linux distributions. The product is used to install packages, and the attack comes from inside the machine. On servers or shared endpoints, an attacker can install malicious software with maximum privileges and compromise the entire system.

What to do

Update PackageKit to version 1.3.5 or later on all Linux servers and endpoints. Identify which machines run affected versions and confirm whether your distribution has packaged the fix.

For the technical team

CVE: CVE-2026-41651
Affected: PackageKit (gerenciador de pacotes, Linux) · PackageKit 1.0.2 through 1.3.4; multiple Linux distributions.
Exploitation: Public proof of concept, link shared by DarkWebInformer. The source reports no in-the-wild exploitation and no KEV listing.
Fix: PackageKit 1.3.5, per the source.
Vector: Time-of-check time-of-use (TOCTOU) race condition in PackageKit transaction flags. Requires an attacker with local access and a low-privileged account; the source states no additional user interaction is needed. The attacker abuses the transaction state to install arbitrary packages as root, including packages with privileged install scripts.
More details: Flaw dubbed Pack2TheRoot. CVSS 8.8 High. Outcome: local privilege escalation to root.