APT flaw lets attackers execute code as root on Linux systems

Debian and Ubuntu have released urgent updates for the APT package manager to fix a critical file check bypass that could allow root code execution. The flaw, tracked as CVE-2026-109518, enables an on‑path attacker or rogue mirror to swap verified files with malicious ones after signature checks have passed, because Linux runs package installs with root privileges.

Security researcher Max Justicz reported the bug to the vendors, with Debian’s APT advisory published on 1 November 2026 and a CVSS 7.7 rating from Canonical in the Ubuntu security blog. At present, there are no confirmed exploits in the wild or public tooling, and impact is described as “RCE via hard link reuse” for affected installations.

Debian notes risk across versions under 1.2.36, 1.4.0, 1.6.0, 1.8.0, 1.8.3, 2.0.0 and more, while Ubuntu lists affected releases including 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10. The patches are identified in the advisories as Debian 3.0.4 for Debian 13 and 2.6.2 for Debian 12, plus updates for Debian 11 and corresponding Ubuntu builds (e.g., 2.4.15ubuntu0.1 for 22.04 LTS and 3.3.3ubuntu0.1 for 26.10).

The attack chain described involves fetching a .deb over HTTP, where an on‑path attacker or compromised mirror issues redirects and errors to force a retry, and the APT client mishandles file checks to overwrite hardlinks with the attacker’s file. This can allow installation of an unsigned package even when signature verification would normally fail, with the package scripts then running with root privileges.

The vulnerability also affects tools that use the HTTP backend, including apt, apt‑get, and aptitude; HTTPS or FTP links are not implicated. In addition to CVE-2026-109518, the update bundle fixes related out‑of‑bounds memory issues and a memory drain condition that could crash services or log excessively during retries.

Administrators are urged to apply patched builds (e.g., 1.2.36, 1.4.12, 1.6.19, 1.8.2.4 and successors) and consider disabling retries or switching from HTTP to HTTPS to reduce exposure during remediation, per the Debian and Ubuntu advisories.