Security Digest · Vulnerability record
CVE-2026-109518: APT RCE via hard link reuse
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve…
CVSS 7.7 High Patch this week
Should you act?
Normal patch cycle
No exploitation signal; fix it in your next routine update if you are affected. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- Editorial verdict: Patch this week. APT CVE-2026-109518: Package Swap to Root on Debian/Ubuntu — Nobody is known to be exploiting it and the attacker must sit between you and your mirror, but APT is the trust root for every Debian and Ubuntu machine and image you build, so update apt itself this week and rebuild base images.
What it is
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration
Weakness type: CWE-62, CWE-367.
Product: Debian APT · Assigned by: canonical · Published: 2026-11-04
Affected and fixed versions
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| Debian | APT | < 1.2.36, 1.4.0 < 1.4.12, 1.6.0 < 1.6.19, 1.8.0 < 1.8.2.4, 1.8.3 <= 1.8.5, 2.0.0 < 2.0.12, 2.2.0 < 2.2.5, 2.4.0 < 2.4.15, 2.6.0 < 2.6.2, 2.8.0 < 2.8.4, 3.0.0 < 3.0.4, 3.2.0 < 3.2.1 |
| Ubuntu | APT | < 1.0.1ubuntu2.24+esm4, 1.2.0 < 1.2.36+esm1, 1.6.0 < 1.6.19+esm1, 2.0.0 < 2.0.12+esm1, 2.4.0 < 2.4.15ubuntu0.1, 2.8.0 < 2.8.4ubuntu0.1, 3.2.0 < 3.2.1ubuntu0.1, 3.3.0 < 3.3.3ubuntu0.1 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| canonical | 4.0 | 7.7 High | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Attack requirements: present (depends on deployment conditions)
- Privileges required: none (no login)
- User interaction: passive
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
Timeline
- — CVE record published by canonical
- — erroneo.us brief: APT CVE-2026-109518: Package Swap to Root on Debian/Ubuntu
- — CVE record last updated
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vendor and project advisories, patches
- lists.debian.org lists.debian.org
- ubuntu.com ubuntu.com
Vulnerability records
- CVE.org record CVE-2026-109518 cve.org
- NVD entry CVE-2026-109518 nvd.nist.gov
Other references from the CVE record and advisory
- lists.debian.org lists.debian.org
- openwall.com openwall.com