kowntaewook/cve-2026-41651-analysisIn-depth analysis of CVE-2026-41651 (Pack2TheRoot), a local privilege escalation in PackageKit. Includes vulnerability breakdown, attack chain, IoCs, and mitigation guidance.
PackageKit Local Privilege Escalation (TOCTOU Race Condition)
CVSS v3.1: 8.8 (HIGH) | CWE-367 | Published: 2026-04-22
This repository compiles a personal analysis report and research material on the PackageKit local privilege escalation vulnerability CVE-2026-41651 (Pack2TheRoot) disclosed in April 2026.
| Item | Details |
|---|---|
| CVE ID | CVE-2026-41651 |
| Vulnerability Name | Pack2TheRoot |
| Affected Software | PackageKit 1.0.2 ~ 1.3.4 |
| Patched Version | PackageKit 1.3.5 |
| Attack Type | Local Privilege Escalation (LPE) |
| Discovered By | Deutsche Telekom Red Team |
Three bugs in PackageKit's pk-transaction.c work in combination, allowing a local unprivileged user to gain root privileges.
Bug 1: cached_transaction_flags unconditionally overwritten when InstallFiles() is called (Line 4036)
↓
Bug 2: Contaminated flags remain in memory without rollback when state transition is denied (Line 876~881)
↓
Bug 3: Contaminated flags are read at the time pk_transaction_run() executes (Line 2273~2277)
↓
Result: polkit authentication bypass → arbitrary package installation as root → SUID bash creation
InstallFiles(SIMULATE=0x4, dummy) asynchronously → bypass polkit authenticationInstallFiles(NONE=0x0, payload) immediately → flag contamination (TOCTOU)NOT_AUTHORIZED is received, the package installation is already complete/tmp/.suid_bash created → euid=0(root) obtained| Item | Details |
|---|---|
| PoC Reproduction | Docker (Ubuntu 24.04.4 LTS) |
| IoC Collection | VirtualBox (Ubuntu 22.04.5 LTS, PackageKit 1.2.5) |
| Code Analysis | GitHub — PackageKit commit 2149735 (vulnerable) / 76cfb675 (patched) |
CVE-2026-41651-analysis/
├── README.md
└── CVE-2026-41651_분석보고서.docx # Detailed analysis report
The following log patterns are recorded on the system during an attack attempt.
# Detection commands
journalctl -u packagekit | grep -i "assertion\|emitted\|failed"
PackageKit[PID]: pk_backend_job_emit: assertion 'PK_IS_BACKEND_JOB(job)' failed
PackageKit[PID]: g_signal_emit_valist: assertion 'G_TYPE_CHECK_INSTANCE(instance)' failed
PackageKit[PID]: GLib-Object:CRITICAL: g_object_unref: assertion 'G_IS_OBJECT(object)' failed
PackageKit[PID]: backend job failed
PackageKit[PID]: emit transaction failed
PackageKit[PID]: daemon stop ← crash
PackageKit[PID]: daemon start ← automatic restart
# SUID file detection
find /tmp -perm -4000 -type f 2>/dev/null
# → immediate response required if /tmp/.suid_bash exists
# Ubuntu / Debian
sudo apt update && sudo apt upgrade packagekit
# RHEL / Fedora
sudo dnf update PackageKit
# Version check (vulnerable if 1.3.4 or lower)
dpkg -l | grep -i packagekit # Debian/Ubuntu
rpm -qa | grep -i PackageKit # RHEL/Fedora
# Check daemon status
systemctl status packagekit
# Disable PackageKit
sudo systemctl disable --now packagekit
⚠️ Disabling it makes GUI package management tools such as GNOME Software unavailable
This repository was created for security research and educational purposes.
Exploiting vulnerabilities or unauthorized system access may result in legal penalties, and all tests were conducted in isolated environments owned by the author.
| Date | Details |
|---|
| 2026-04-08 | Deutsche Telekom Red Team → Initial report to Red Hat/PackageKit |
| 2026-04-10 | PackageKit maintainers acknowledged and confirmed reproduction |
| 2026-04-13 | Private patch draft created |
| 2026-04-15 | Vulnerability shared with Canonical |
| 2026-04-19 | Private notification to distribution vendors |
| 2026-04-22 | PackageKit 1.3.5 released, CVE assigned, public disclosure |