Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit

🗓️ 25 Apr 2026 03:29:30Reported by dinosnType

githubexploit

githubexploit🔗 github.com👁 207 Views

TOCTOU race in PackageKit (CVE-2026-41651) enables root via unsigned package post scriptlet in Pack2TheRoot lab.

Reporter	Title	Published	Views	Family All 140
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	3 May 202602:54	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	6 May 202606:12	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	29 Apr 202615:40	–	githubexploit
GithubExploit	Exploit for CVE-2026-41651	24 Apr 202610:32	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	20 May 202607:26	–	githubexploit
GithubExploit	Exploit for CVE-2026-41651	23 Apr 202609:58	–	githubexploit
GithubExploit	Exploit for CVE-2026-41651	23 Apr 202608:57	–	githubexploit
GithubExploit	Pack2TheRoot	27 Apr 202609:13	–	githubexploit
ATTACKERKB	CVE-2026-41651	22 Apr 202613:11	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : PackageKit, PackageKit-command-not-found, PackageKit-cron (ALAS2023-2026-1639)	20 May 202600:00	–	nessus

25 Apr 2026 03:29Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.18.8

EPSS0.00413

SSVC

toctou race packagekit daemon local privilege escalation unsigned packages polkit weakness pack2theroot