CVE-2026-41651

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>PackageKit-Qt</name>
	<range><lt>1.3.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>PackageKit is a a D-Bus abstraction layer that allows the user to
	manage packages in a secure way using a cross-distro,
	cross-architecture API. PackageKit between and including versions
	1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU)
	race condition on transaction flags that allows unprivileged users to
	install packages as root and thus leads to a local privilege
	escalation. This is patched in version 1.3.5.

A local unprivileged
	user can install arbitrary RPM packages as root, including executing
	RPM scriptlets, without authentication. The vulnerability is a TOCTOU
	race condition on `transaction->cached_transaction_flags`  combined
	with a silent state-machine guard that discards illegal backward
	transitions while leaving corrupted flags in place. Three bugs exist
	in `src/pk-transaction.c`:
1. Unconditional flag overwrite (line
	4036): `InstallFiles()` writes caller-supplied flags to
	`transaction->cached_transaction_flags` without checking whether the
	transaction has already been  authorized/started. A second call
	blindly overwrites the flags even while the transaction is RUNNING.
2.
	Silent state-transition rejection (lines 873–882):
	`pk_transaction_set_state()` silently discards backward state
	transitions (e.g. `RUNNING` → `WAITING_FOR_AUTH`) but the flag
	overwrite at step 1 already happened. The transaction continues
	running with corrupted flags.
3. Late flag read at execution time
	(lines 2273–2277): The scheduler's idle callback reads
	cached_transaction_flags at dispatch time, not at authorization time.
	If flags were overwritten between authorization and execution, the
	backend sees the attacker's flags.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-41651</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-41651</url>
    </references>
    <dates>
      <discovery>2026-04-22</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>