CVE-2026-41651 – TOCTOU LPE in PackageKit 1.0.2-1.3.4

CVE-2026-41651 is a race condition vulnerability in PackageKit's transaction management that allows local unprivileged users to install arbitrary RPM packages and execute code as root. It affects all versions from 1.0.2 to 1.3.4 of this core component on RPM-based Linux systems (Red Hat, CentOS, Fedora). The attack requires only local access: a non-root user can exploit the TOCTOU defect to modify transaction flags between authorization and execution, completely bypassing the D-Bus security controls.

The official CVSS score is 8.8 (high). The vulnerability is patched in PackageKit 1.3.5, available since 22 April 2026. On 6 November 2026, PoC and exploit code for this flaw have been publicly reported on GitHub, indicating that malicious code availability is concrete and imminent. System administrators and IT teams must consider this an immediate threat, especially in environments where users with local shell access are present and for centrally managed development or administrative systems.

Immediate action: verify PackageKit version on all Red Hat family systems. Maximum priority for multi-user systems, development servers, and administrative workstations. Apply update to 1.3.5 or later through official distribution repositories. Where updates are impeded, evaluate temporary disabling of PackageKit if non-critical, or isolation of vulnerable systems until patched. Check PackageKit logs for suspicious package installation activity or scriptlet execution.