CVE-2026-109518: APT RCE via hard link reuse
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.
The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/aptto a version that resolves this vulnerability.Fixed in 2.6.2 - Upgrade
Upgrade
debian/aptto a version that resolves this vulnerability.Fixed in 3.0.4 - Upgrade
Upgrade
debian/aptto a version that resolves this vulnerability.Fixed in 2.6.2Fixed in 3.0.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch DSA 6607-1 - Configuration
Set Acquire::Retries to 0 to prevent the non-zero retry condition required for exploitation.
APT Acquire::Retries = 0
Event History
Frequently Asked Questions
Which systems are affected by default?
Debian 12 (bookworm), Ubuntu 22.04 LTS (Jammy Jellyfish), and derivatives are affected in their default configuration because Acquire::Retries defaults to 3. Older releases are unaffected when left at their default configuration.
What conditions must an attacker meet to exploit this?
The attacker must be able to manipulate HTTP traffic between the APT client and the archive server, such as through a malicious mirror or proxy. Exploitation also requires a package installation, redirect following, a retried package download, and a non-zero Acquire::Retries setting.
What can be changed if patching is not immediately possible?
Set Acquire::Retries to zero, because exploitation requires a non-zero value. This may reduce APT's ability to recover automatically from failed package downloads.
How serious is successful exploitation?
A successful attacker can cause installation of an attacker-controlled unverified package and obtain remote code execution with root privileges. Public exploit code was published on 2026-10-23.