Loading story…
A local privilege escalation flaw in PackageKit tracked as CVE-2026-41651 allows an unprivileged user to exploit a time-of-check/time-of-use race condition and install or remove arbitrary packages with root privileges. The issue, dubbed Pack2TheRoot, affects PackageKit versions 1.0.2 through 1.3.4 and was discovered by Deutsche Telekom’s Red Team during research into Linux privilege-escalation paths. Researchers said exploitability was confirmed on default installations using both apt and dnf backends, including Ubuntu, Debian, Rocky Linux, and Fedora, indicating broad exposure across Linux distributions.
PackageKit 1.3.5 fixes the vulnerability, and maintainers said Linux distributors were notified in advance so updates could be prepared before public disclosure. A GitHub Security Advisory, Telekom’s technical write-up, an oss-sec disclosure, and a Debian security update were released as patches became available, while some technical details were initially withheld to reduce the risk of immediate weaponization. Because the vulnerable code path dates back more than a decade, the flaw may affect a wide installed base on systems where PackageKit is present and unpatched.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Deutsche Telekom researchers published a proof of concept for CVE-2026-41651, demonstrating how the PackageKit TOCTOU flaw could be exploited for local privilege escalation to root. They also noted exploitation may leave forensic evidence because PackageKit often crashes and logs an assertion failure after the exploit runs.
Debian published security advisory DSA-6226-1 to distribute a PackageKit security update addressing CVE-2026-41651. This marked downstream remediation for Debian systems affected by the vulnerability.
Telekom Security published a blog post on Pack2TheRoot, identifying the issue as CVE-2026-41651 and describing it as a cross-distribution local privilege escalation vulnerability. The post accompanied public disclosure of the flaw and fix.
A GitHub Security Advisory documented the Pack2TheRoot vulnerability, affected PackageKit versions, and the patched release 1.3.5. The advisory highlighted the broad attack surface due to the flaw existing since PackageKit 1.0.2.
PackageKit version 1.3.5 was released as the patched version for the local privilege escalation vulnerability affecting versions 1.0.2 through 1.3.4. The fix addressed the race condition that allowed arbitrary package installation as root.
Matthias Klumpp publicly disclosed CVE-2026-41651 on the oss-sec mailing list, describing a TOCTOU vulnerability in PackageKit up to and including version 1.3.4 that could let a local user install or remove arbitrary packages and gain root. The disclosure noted that full technical details were being limited initially to give users time to update.
Before public disclosure, distributors were notified through direct outreach and the distros@ coordination channel so patched packages could be prepared. This coordinated disclosure preceded the public release of technical details and fixes.
Deutsche Telekom’s Red Team identified a time-of-check/time-of-use race condition in PackageKit, later named Pack2TheRoot, during research into local privilege escalation paths on Linux. The flaw was confirmed as exploitable on default installations using apt and dnf backends across Ubuntu, Debian, Rocky Linux, and Fedora.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
14 references tracked. Mallory keeps watching after this page renders.
hackers-arise.com
Open sourcecsirt.sk
Open sourcehackread.com
Open sourcescworld.com
Open sourcegithub.security.telekom.com
Open sourcegithub.com
Open sourceseclists.org
Open sourceopennet.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-5140**, a critical local privilege escalation chain in Pardus Linux that lets any unprivileged local user gain **root** access without authentication through the `pardus-update` package. The flaw carries a **CVSS v3.1 score of 9.3** and was identified by security researcher **Çağrı Eser (`0xc4gr1`)**. The issue combines three weaknesses: an overly permissive **Polkit** policy, a **CRLF injection** flaw in `SystemSettingsWrite.py`, and an **untrusted search path** issue in `AutoAptUpgrade.py`. Attackers can exploit the chain by injecting a malicious APT source path, causing the system to install a crafted Debian package with elevated privileges, and then obtaining a root shell by setting the **SUID** bit on `/bin/bash`. The exposure is particularly serious because Pardus Linux, maintained by **TÜBİTAK**, is widely deployed across Turkish government, education, and enterprise environments, especially on shared or multi-user systems. Recommended mitigations include tightening Polkit rules to require administrator authentication, sanitizing carriage return and newline characters in user input, and restricting APT source paths to trusted directories.
Jun 29, 2026
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 23, 2026