CVE-2026-41651

A flaw was found in PackageKit. A time-of-check time-of-use (TOCTOU) race condition on transaction flags allows unprivileged users to install packages as root, resulting in a local privilege escalation.

To exploit this issue, an attacker needs local access to the system and basic permissions to install packages via PackageKit, limiting its exposure to authenticated users. As this flaw allows a local user to escalate its privileges, specifically gaining administrative permissions, this vulnerability has been rated with an important severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, mask the PackageKit service. Note that graphical package managers, such as GNOME software, will not work as expected until the service is unmasked.

sudo systemctl stop packagekit.service
sudo systemctl mask packagekit.service