Loading vulnerability…
APT root remote code execution via hard-link reuse
CVE-2026-109518 is a package-verification bypass in APT on Debian, Ubuntu, and derivative Linux distributions. HTTP redirects can cause two distinct package downloads to resolve to the same URI, merging their download handling. Incorrect reuse of hard links during interrupted-download retries then allows an attacker controlling package-download responses to overwrite a package after its integrity has been verified but before installation. By combining redirects with transient HTTP errors, an on-path attacker, malicious mirror, or response-manipulating proxy can substitute an unverified package and execute arbitrary code as root. Exploitation requires a nonzero Acquire::Retries setting.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises package integrity and can result in complete compromise of the affected system's confidentiality, integrity, and availability. Attacker-controlled package maintainer scripts execute with root privileges during installation. On build hosts or CI runners, compromise can additionally expose accessible credentials, signing keys, and source code, or introduce malicious code into subsequently distributed images and artifacts.
If you can’t patch tonight, do this now.
On unpatched systems, set Acquire::Retries=0 to prevent the retry behavior required for exploitation, including during installation of the security update. Disabling retries can reduce download reliability. Prefer trusted mirrors and properly validated HTTPS connections to prevent network intermediaries from modifying package traffic. HTTPS does not protect against a malicious mirror or a trusted TLS-terminating proxy that controls responses, and it does not replace patching.
Patch, then assume compromise.
Install the distribution-provided corrected APT packages and verify the installed versions. Debian fixes include APT 2.6.2 for Debian 12, 3.0.4 for Debian 13, and 3.3.6 for unstable. Ubuntu fixes include 2.4.15ubuntu0.1 for 22.04 LTS, 2.8.4ubuntu0.1 for 24.04 LTS, 3.2.1ubuntu0.1 for 26.04 LTS, and 3.3.3ubuntu0.1 for 26.10. Older supported branches require their applicable vendor updates and, where necessary, extended-support coverage. Set Acquire::Retries=0 while obtaining and installing the update so that remediation does not use the vulnerable retry path. Rebuild and redeploy affected container and runner images; patching a running instance does not correct its source image.
No validated public exploits yet. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
103 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.