USN-8969-1: Ubuntu patches 22 vulnerabilities in Bind, one leading to RCE

Ubuntu published security advisory USN-8969-1 on 3 November 2026, addressing 22 vulnerabilities in bind9, the most widely deployed DNS server on Linux distributions. Administrators managing resolvers or authoritative nameservers on Ubuntu 26.10, 26.04 LTS, 24.04 LTS or 22.04 LTS should update the package without delay.

The critical flaw: CVE-2026-94300

Of the 22 CVEs, only one carries a code execution risk. According to the advisory, Bind incorrectly handled shared access to GSS-TSIG security contexts, allowing a remote attacker to potentially exploit this issue to corrupt memory and execute arbitrary code (CVE-2026-94300). Unlike the other 13 flaws in the same series, this one affects LTS versions as well, not just Ubuntu 26.10.

The actual attack vector, according to the ISC advisory cited by Red Hat, requires an attacker to capture a valid UDP message signed with GSS-TSIG and replay it while the negotiated key remains active. Red Hat rates the risk as important rather than critical because whilst unauthenticated remote code execution is possible, successful exploitation depends on capturing active cryptographic keys and orchestrating complex concurrent requests; in standard installations, the BIND daemon does not enable GSS-TSIG by default, restricting the risk to servers integrated with Kerberos infrastructure such as Active Directory or FreeIPA.

Those not using GSS-TSIG for authenticated dynamic updates can disable the feature by commenting out the tkey-gssapi-keytab and tkey-gssapi-credential directives in the configuration file and restarting the service, as indicated in the Red Hat advisory itself.

The remaining 21 flaws

The bulk of the fixes address denial of service: incorrect handling of repeated SOA/CNAME/DNAME records, cached DNSSEC proofs, malformed TKEY queries, malformed DNS64 responses, compression pointers in incoming messages. Some affect response integrity: incorrect verification of TSIG signatures in zone transfers (CVE-2026-19033), which can allow unauthorised zone content injection on a secondary server, and incorrect validation of NSEC3 records from unrelated sibling zones (CVE-2026-77119), which permits a DNSSEC downgrade.

How to update

The corrected versions are: bind9 1:9.20.24-1ubuntu3.1 for Ubuntu 26.10 and 26.04 LTS, 1:9.18.39-0ubuntu0.24.04.9 for 24.04 LTS, 1:9.18.39-0ubuntu0.22.04.8 for 22.04 LTS. A standard system update (apt update && apt upgrade) applies the patches. After installation, restart the named/bind9 service to load the correct binaries.