APT's developers said on 4 November that CVE-2026-109518 lets an attacker bypass the check on downloaded packages in APT, the Debian and Ubuntu package tool. They rate it critical. The Hacker News reported that, per Ubuntu, the attacker must be able to alter HTTP traffic between APT and the package server, for example through a malicious mirror or proxy. Redirects and routine server errors make APT retry a download. APT's developers say the retry ends with an existing hard link, a second name for one file, being overwritten with the attacker's file. Packages install as root, so code could potentially run as root.
Retries are on by default from APT 2.3.2, which The Hacker News ties to Debian 12 and Ubuntu 22.04 onward. APT's developers say scripts on older releases may have enabled Acquire::Retries too. Fixes exist for eleven stable branches. The Hacker News said Ubuntu still listed all its tracked releases as vulnerable that afternoon. No attacks or workaround are reported, and the sources do not say whether HTTPS sources are affected.
A feature built to cope with failed downloads became the way around the package check. That is our reading of the facts. Teams can check which APT versions their machines run, whether scripts set Acquire::Retries on older releases, and whether any package traffic passes through HTTP mirrors or proxies.