Local Privilege Escalation in PackageKit via TOCTOU Race Condition

CVE-2026-41651 is a local privilege escalation vulnerability in PackageKit versions 1.0.2 through 1.3.4. The vulnerability arises from a Time-of-check Time-of-use (TOCTOU) race condition within the D-Bus transaction handler, specifically in src/pk-transaction.c. An unprivileged local user can exploit three chained bugs: unconditional flag overwrites, a flawed state-machine guard, and late flag reads during transaction dispatch. By utilizing the PK_TRANSACTION_FLAG_SIMULATE flag, an attacker can bypass PolKit authorization checks. This allows a local attacker to install arbitrary packages as root, ultimately facilitating the creation of SUID binaries for full system compromise. The vulnerability affects major Linux distributions, including Ubuntu, Debian, Fedora, and RockyLinux, provided the packagekitd service is active.

Attack Chain

1. The attacker initiates a D-Bus transaction with the PackageKit daemon, setting the transaction state to NEW.
2. The attacker sends an InstallFiles() request with the PK_TRANSACTION_FLAG_SIMULATE flag, causing the daemon to skip PolKit authorization checks.
3. The daemon moves the transaction to a READY state and queues it as a GLib idle event.
4. The attacker sends a second InstallFiles() request on the same transaction using their intended malicious payload.
5. The daemon's flawed state-machine guard rejects the second state transition but fails to roll back the malicious flags and file paths overwritten in the previous step.
6. When the GLib idle event fires, pk_transaction_run() is invoked, reading the attacker's corrupted flags and path instead of the authorized ones.
7. The backend processes the malicious package as root, executing its post-installation script.
8. The post-installation script creates a SUID binary (e.g., /tmp/.suid_bash), which the attacker executes to gain root-level privileges.

Impact

Successful exploitation results in full local root privilege escalation. The vulnerability affects a wide range of Linux distributions including Ubuntu, Debian, Fedora, and RockyLinux. Any local user with an active session can exploit this to achieve persistence or system-wide compromise, impacting the integrity and availability of the affected host.

Recommendation

• Upgrade PackageKit to version 1.3.5 or higher immediately.
• If an upgrade is not feasible, mask the PackageKit service using systemctl mask packagekit to prevent the vulnerable daemon from running.
• Audit /tmp and similar temporary directories for unexpected SUID binaries, specifically looking for files created by dpkg or unauthorized installation processes.
• Monitor for the presence of unusual .deb packages being processed by packagekitd in environments where package management activity is typically restricted.