OESA-2026-2140 PackageKit security update

🗓️ 03 May 2026 09:55:53Reported by GoogleType

osv🔗 osv.dev👁 5 Views

PackageKit security update fixes a TOCTOU race that lets unprivileged users install packages as root via transaction flags (CVE-2026-41651).

Reporter	Title	Published	Views	Family All 139
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	3 May 202602:54	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	6 May 202606:12	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	25 Apr 202603:29	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	29 Apr 202615:40	–	githubexploit
GithubExploit	Exploit for CVE-2026-41651	24 Apr 202610:32	–	githubexploit
GithubExploit	Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit	20 May 202607:26	–	githubexploit
GithubExploit	Exploit for CVE-2026-41651	23 Apr 202609:58	–	githubexploit
GithubExploit	Exploit for CVE-2026-41651	23 Apr 202608:57	–	githubexploit
GithubExploit	Pack2TheRoot	27 Apr 202609:13	–	githubexploit
ATTACKERKB	CVE-2026-41651	22 Apr 202613:11	–	attackerkb

Source	Link
openeuler	www.openeuler.org/zh/security/security-bulletins/detail/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41651

03 May 2026 10:19Current

6Medium risk

Vulners AI Score6

CVSS 3.18.8

EPSS0.00153

SSVC