CVE catalog

CVE-2026-41651

PackageKit is a a D-Bus abstraction layer that allows…

PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: 1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction has already been authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING. 2. Silent state-transition rejection (lines 873–882): `pk_transaction_set_state()` silently discards backward state transitions (e.g. `RUNNING` → `WAITING_FOR_AUTH`) but the flag overwrite at step 1 already happened. The transaction continues running with corrupted flags. 3. Late flag read at execution time (lines 2273–2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at authorization time. If flags were overwritten between authorization and execution, the backend sees the attacker's flags.

Severity: High · CVSS 8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published: Apr 21, 2026, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.46% · Oct 27, 2026

Projects and upstream resources

[packagekit][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "packagekit",
      "status": "fixed",
      "release": "sid",
      "version": "1.4.0-1"
    },
    {
      "name": "packagekit",
      "status": "fixed",
      "release": "forky",
      "version": "1.4.0-1"
    },
    {
      "name": "packagekit",
      "status": "fixed",
      "release": "trixie",
      "version": "1.3.1-1+deb13u1"
    },
    {
      "name": "packagekit",
      "status": "fixed",
      "release": "trixie-security",
      "version": "1.3.1-1+deb13u1"
    },
    {
      "name": "packagekit",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.2.6-5+deb12u1"
    },
    {
      "name": "packagekit",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "1.2.6-5+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "packagekit",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.3.5-1"
    },
    {
      "bug": null,
      "name": "packagekit",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.3.5-1"
    },
    {
      "bug": null,
      "name": "packagekit",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.3.1-1+deb13u1"
    },
    {
      "bug": null,
      "name": "packagekit",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.2.6-5+deb12u1"
    }
  ],
  "distribution_packages": [
    {
      "name": "packagekit",
      "ecosystem": "cpe",
      "fixed_version": "1.3.5"
    },
    {
      "name": "packagekit",
      "ecosystem": "cpe",
      "fixed_version": "1.2.6-5+deb12u1"
    },
    {
      "name": "packagekit",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.13-2ubuntu1.1+esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.1.12-5ubuntu4",
        "1.1.13-1",
        "1.1.13-2",
        "1.1.13-2build1",
        "1.1.13-2ubuntu1",
        "1.1.13-2ubuntu1.1"
      ],
      "ecosystem": "deb",
      "fixed_version": "1.1.13-2ubuntu1.1+esm1",
      "provider_record_id": "UBUNTU-CVE-2026-41651"
    },
    {
      "name": "packagekit",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.5-2ubuntu3.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "1.2.2-2ubuntu3",
        "1.2.4-1ubuntu1",
        "1.2.4-1ubuntu2",
        "1.2.5-1ubuntu1",
        "1.2.5-2ubuntu1",
        "1.2.5-2ubuntu2",
        "1.2.5-2ubuntu3"
      ],
      "ecosystem": "deb",
      "fixed_version": "1.2.5-2ubuntu3.1",
      "provider_record_id": "UBUNTU-CVE-2026-41651"
    },
    {
      "name": "packagekit",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.8-2ubuntu1.5"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "1.2.7-1",
        "1.2.8-1",
        "1.2.8-1build1",
        "1.2.8-2",
        "1.2.8-2build2",
        "1.2.8-2build3",
        "1.2.8-2ubuntu1",
        "1.2.8-2ubuntu1.1",
        "1.2.8-2ubuntu1.2",
        "1.2.8-2ubuntu1.4"
      ],
      "ecosystem": "deb",
      "fixed_version": "1.2.8-2ubuntu1.5",
      "provider_record_id": "UBUNTU-CVE-2026-41651"
    },
    {
      "name": "packagekit",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.1-1ubuntu1.1"
            }
          ]
        }
      ],
      "release": "25.10",
      "versions": [
        "1.3.0-3build1",
        "1.3.1-1",
        "1.3.1-1ubuntu1"
      ],
      "ecosystem": "deb",
      "fixed_version": "1.3.1-1ubuntu1.1",
      "provider_record_id": "UBUNTU-CVE-2026-41651"
    },
    {
      "name": "packagekit",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.4-3ubuntu1"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "1.3.1-1",
        "1.3.2-1",
        "1.3.3-1",
        "1.3.4-1",
        "1.3.4-3"
      ],
      "ecosystem": "deb",
      "fixed_version": "1.3.4-3ubuntu1",
      "provider_record_id": "UBUNTU-CVE-2026-41651"
    },
    {
      "name": "PackageKit",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.5-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.3.5-1.1",
      "provider_record_id": "OPENSUSE-SU-2026:10629-1"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[gir1.2-packagekitglib-1.0]Unknown
Source package: [packagekit]
Details (4)
- 1.2.6-5+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
[gstreamer1.0-packagekit]Unknown
Source package: [packagekit]
Details (4)
- 1.2.6-5+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
[libpackagekit-glib2-18]Unknown
Source package: [packagekit]
Details (4)
- 1.2.6-5+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
[libpackagekit-glib2-dev]Unknown
Source package: [packagekit]
Details (4)
- 1.2.6-5+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
[packagekit]Unknown
Details (4)
- 1.2.6-5+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
[packagekit-command-not-found]Unknown
Source package: [packagekit]
Details (4)
- 1.2.6-5+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
[packagekit-docs]Unknown
Source package: [packagekit]
Details (4)
- 1.2.6-5+deb12u1 · all · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · all · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · all · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · all · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
[packagekit-gtk3-module]Unknown
Source package: [packagekit]
Details (4)
- 1.2.6-5+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
[packagekit-tools]Unknown
Source package: [packagekit]
Details (4)
- 1.2.6-5+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12
- 1.2.6-5+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 1.2.6-5+deb12u1
  nvd · packagekit · debian · bookworm; nvd · packagekit · debian · 12

[Debian 13 (Trixie)]

[gir1.2-packagekitglib-1.0]Unknown
Source package: [packagekit]
Details (4)
- 1.3.1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
[gstreamer1.0-packagekit]Unknown
Source package: [packagekit]
Details (4)
- 1.3.1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
[libpackagekit-glib2-18]Unknown
Source package: [packagekit]
Details (4)
- 1.3.1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
[libpackagekit-glib2-dev]Unknown
Source package: [packagekit]
Details (4)
- 1.3.1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
[packagekit]Unknown
Details (4)
- 1.3.1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
[packagekit-command-not-found]Unknown
Source package: [packagekit]
Details (4)
- 1.3.1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
[packagekit-docs]Unknown
Source package: [packagekit]
Details (4)
- 1.3.1-1+deb13u1 · all · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · all · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
[packagekit-gtk3-module]Unknown
Source package: [packagekit]
Details (4)
- 1.3.1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
[packagekit-tools]Unknown
Source package: [packagekit]
Details (4)
- 1.3.1-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13
- 1.3.1-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 1.3.1-1+deb13u1
  nvd · packagekit · debian · 13

[openSUSE Tumbleweed]

[libpackagekit-glib2-18]Unknown
Source package: [PackageKit]
Details (1)
- 1.3.6-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.3.5-1.1
  Version impact unknown
  nvd · PackageKit · opensuse · tumbleweed
[libpackagekit-glib2-devel]Unknown
Source package: [PackageKit]
Details (1)
- 1.3.6-2.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.3.5-1.1
  Version impact unknown
  nvd · PackageKit · opensuse · tumbleweed

Next results

Observed: Oct 27, 2026, 7:58:38 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]