High-severity APT flaw lets attackers swap packages after verification - update now

If your computer runs Debian, Ubuntu, Linux Mint or another Debian derivative, check for updates today: a high-severity vulnerability in APT, the package manager shared by all these systems, can let a network attacker replace a package during installation and run code as root on your machine.

What happened

The vulnerability, tracked as CVE-2026-109518 and discovered by Max Justicz, sits in the way APT downloads packages. Canonical's analysis describes the exact conditions: an on-path attacker who can manipulate the HTTP traffic between your machine and the archive server - including a malicious mirror or proxy - can trick APT into installing an attacker-controlled, unverified package and achieve remote code execution with root privileges. The bug is caused by the reuse of hard links, and it only triggers when APT follows a redirect and then retries a download, which requires a non-zero Acquire::Retries setting. That value has defaulted to 3 since Debian 12 (bookworm) and Ubuntu 22.04 LTS, so older releases are not affected in a default configuration.

Because APT runs with full system privileges, a poisoned package means a fully compromised machine. Canonical scores the flaw 7.7 (High) on the CVSS v4.0 scale.

Who is affected, and what is fixed

According to the Debian Security Tracker, fixes are available for Debian stable (trixie) in APT 3.0.4 via advisory DSA-6607-1, and for oldstable (bookworm) in APT 2.6.2 via DLA-4880-1; the unstable branch is fixed in APT 3.3.6. On the Ubuntu side, every supported release from 14.04 LTS to 26.10 is currently listed as vulnerable, with fixed packages still pending at the time of writing. Ubuntu users should watch their update manager for the patched APT package over the coming hours or days. For Linux Mint, which builds on Ubuntu LTS, our sources do not confirm the fix status; the same advice applies once the update appears there.

What you should do

One detail matters here: the attack triggers during a package download, which is exactly what an update does. Apply the fix from a network you trust - your home connection, not cafe or hotel Wi-Fi - since a network attacker is precisely who this flaw empowers. On Debian, run sudo apt update && sudo apt upgrade or use your graphical update tool. On Ubuntu and Linux Mint, install the APT update as soon as it appears; until it does, be extra cautious about installing packages over untrusted networks.

Sources: Ubuntu Security - CVE-2026-109518, Debian Security Tracker, Debian DSA-6607-1, Phoronix, Linuxiac.

Cover: an apt-get package installation session in a terminal (Debian project, via Wikimedia Commons, GPL v2+). It illustrates the tool, not the patched version.