Pardus Linux Vulnerability Lets Local Attackers Gain Silent Root Access

**Executive Summary:** A critical CVE-2026-5140 privilege escalation chain in Pardus Linux's pardus-update utility allows local unprivileged users to obtain full root access by chaining a Polkit authorization bypass, CRLF injection into configuration, and copying attacker-controlled APT sources; the report includes a working proof-of-concept using pkexec and recommends hardening Polkit policies, proper input sanitization, and validation of APT repository paths.