Linux Privilege Escalation: “Pack2TheRoot” Flaw Impacts Major Distributions

Pack2TheRoot (CVE-2026-41651) is a high-severity race-condition vulnerability in PackageKit (versions 1.0.2–1.3.4) that enables local, unprivileged attackers to escalate to root by exploiting a timing window in the package installation process. Discovered by Deutsche Telekom’s Red Team and tested against apt and dnf backends, the flaw affects multiple major Linux distributions (including several Ubuntu, Debian, RockyLinux, and Fedora releases); maintainers released a patch in PackageKit >=1.3.5 and administrators are urged to update immediately.