🔥 CVE-2026-41651 — PackageKit TOCTOU Local Privilege Escalation (Pack2TheRoot)

Local Privilege Escalation exploit targeting the PackageKit daemon.
Escalates from an unprivileged local user to root through a TOCTOU race condition vulnerability.

📌 Overview

CVE-2026-41651 (also known as Pack2TheRoot) is a critical TOCTOU (Time-Of-Check to Time-Of-Use) race condition vulnerability in PackageKit, a system service used by many Linux distributions for package management abstraction.

The vulnerability allows a local unprivileged user to manipulate PackageKit transaction states and bypass authorization checks under specific conditions.

Impact

An attacker with local access may be able to:

• Install arbitrary packages with elevated privileges
• Execute package maintainer scripts as root
• Achieve full local privilege escalation
• Bypass expected polkit authorization behavior

⚠️ Affected Versions

✅ Tested On

• Ubuntu 24.04 (Noble Numbat)
• Ubuntu 22.04 (Jammy Jellyfish)
• Debian 12 (Bookworm)
• Kali Linux (latest)
• Other Debian/Ubuntu-based distributions using vulnerable PackageKit versions

🔬 Technical Details

Root Cause

The issue originates from multiple logic flaws inside src/pk-transaction.c.

Attack Flow

Attacker (unprivileged)                packagekitd (root)
│                                      │
├── 1. InstallFiles(SIMULATE) ───────► │ polkit bypassed → state = READY
│                                      │ queued async dispatch
│
├── 2. InstallFiles(payload) ─────────► │ cached flags overwritten
│                                      │ invalid state transition ignored
│
│ [dispatch occurs]                    │
│                                      │ payload processed as root
│                                      │ maintainer scripts executed
│
└────────────────────────────────────► │ privilege escalation achieved

🚀 Quick Start

Prerequisites

Install required development libraries:

sudo apt update
sudo apt install libglib2.0-dev

Clone Repository

git clone https://github.com/Lutfifakee-Project/CVE-2026-41651.git
cd CVE-2026-41651

Compile

gcc -o exploit CVE-2026-41651.c \
`pkg-config --cflags --libs glib-2.0 gio-2.0` \
-Wall

Run

Run as an unprivileged user.

./exploit

🖥️ Example Output

  ______   ______    ___  ___  ___  ____     ___________ _______
 / ___/ | / / __/___|_  |/ _ \|_  |/ __/____/ / <  / __// __<  /
/ /__ | |/ / _//___/ __// // / __// _ \/___/_  _/ / _ \/__ \/ /
\___/ |___/___/   /____/\___/____/\___/     /_//_/\___/____/_/

CVE-2026-41651 - PackageKit TOCTOU Local Privilege Escalation
═══════════════════════════════════════════════════════════════════

[*] Building packages...
[*] Starting race condition...
[*] Waiting for dispatch...
[*] Polling for payload...
[+] SUCCESS — privilege escalation completed

🛡️ Detection & Mitigation

Check Installed Version

pkcon --version

Or:

dpkg -l | grep packagekit

Version Status

• Vulnerable → 1.0.2 – 1.3.4
• Patched → 1.3.5 or later

Update PackageKit

sudo apt update
sudo apt upgrade packagekit

Manual Patch

Official releases:

• https://github.com/PackageKit/PackageKit/releases

⚠️ Disclaimer

This repository is provided strictly for:

• Security research
• Defensive security testing
• Educational purposes
• Authorized penetration testing

The author is not responsible for any misuse, illegal activity, or damage caused by this project.

Do not use this software against systems you do not own or have explicit permission to test.

📚 References

• NVD — CVE-2026-41651
• GitHub Security Advisory
• PackageKit Security Fix Commit
• OSS-Security Announcement