UBUNTU-CVE-2026-109518: High severity ubuntu/apt vulnerability
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration.
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by default?
The default configuration is affected on Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish) and later where Acquire::Retries defaults to 3. Older releases are unaffected in their default configuration, though they may be exposed if Acquire::Retries has been set to a non-zero value.
What conditions must an attacker meet to exploit this?
The attacker must be on path for HTTP traffic between the APT client and archive server, such as through a malicious mirror or proxy. Exploitation also requires a package installation, redirect following, a retried package-file download, and a non-zero Acquire::Retries setting; user interaction is required.
What is the impact of successful exploitation?
An attacker can cause APT to install an attacker-controlled, unverified package. This can result in remote code execution with root privileges.
What can be done if an update cannot be applied immediately?
Set Acquire::Retries to zero to remove the retry condition required for exploitation. Avoid using untrusted HTTP mirrors or proxies and prevent on-path manipulation of APT HTTP traffic.