Pack2TheRoot Flaw Lets Local Linux Users Gain Root via PackageKit

A high‑severity vulnerability in the PackageKit daemon, named Pack2TheRoot (CVE-2026-41651), could allow a local Linux user to install or remove system packages with root privileges without proper authentication. The flaw spans PackageKit versions 1.0.2 through 1.3.4 and is fixed in 1.3.5; researchers warn that many distros using PackageKit could be affected. Users should upgrade to PackageKit 1.3.5 and verify installations using commands like dpkg -l | grep -i packagekit or rpm -qa | grep -i packagekit, and ensure the PackageKit daemon is running (systemctl status packagekit or pkmon). Patch details have not been disclosed to aid propagation, and exploitation could crash the daemon, making indicators visible in logs.