{"id":"CLSA-2026-1778773906","summary":"PackageKit: Fix of CVE-2026-41651","details":"- CVE-2026-41651: fix TOCTOU race on cached transaction flags that allowed\n  unprivileged users to install arbitrary RPM packages as root via the\n  PackageKit D-Bus interface, leading to local privilege escalation; reject\n  re-invocation of action methods on transactions that have left the NEW state.","modified":"2026-06-01T00:32:52.233675461Z","published":"2026-05-14T18:20:07Z","upstream":["CVE-2026-41651"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1778773906.html"}],"affected":[{"package":{"name":"PackageKit","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/PackageKit?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1778773906.json"}},{"package":{"name":"PackageKit-command-not-found","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/PackageKit-command-not-found?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1778773906.json"}},{"package":{"name":"PackageKit-cron","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/PackageKit-cron?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1778773906.json"}},{"package":{"name":"PackageKit-glib","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/PackageKit-glib?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1778773906.json"}},{"package":{"name":"PackageKit-glib-devel","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/PackageKit-glib-devel?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1778773906.json"}},{"package":{"name":"PackageKit-gstreamer-plugin","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/PackageKit-gstreamer-plugin?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1778773906.json"}},{"package":{"name":"PackageKit-gtk3-module","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/PackageKit-gtk3-module?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-1.el9.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1778773906.json"}}],"schema_version":"1.7.5"}