USN-8996-1: APT flaw allows installation of unverified packages as root

Canonical released security advisory USN-8996-1 on 4 November 2026, patching a flaw in APT that allows installation of unverified packages with administrator privileges. For those managing Ubuntu server fleets, the issue strikes at the heart of the update system: if an attacker positions themselves on the network path, they can under certain conditions achieve remote code execution as root during a routine apt update && apt upgrade.\n\n## The bug: hard links, redirects and retries\n\nResearcher Max Justicz discovered that APT incorrectly handles hard links when encountering redirects and retrying package downloads. In practice, a remote on-path attacker could exploit the issue to trick APT into installing an unverified package and gain remote code execution with root privileges.\n\nThe mechanism, tracked as CVE-2026-109518, occurs when a redirect causes two different downloads to point to the same URI: according to the Debian advisory, APT can merge two separate package downloads when a redirect causes them to share the same URI. When the download is then resumed, incorrect handling of reused hard links can allow the content associated with an already-verified package to be overwritten. Canonical, in its capacity as CVE Numbering Authority, assigns a score of 7.7 High under CVSS 4.0.\n\nThe practical exposure condition: the issue affects Ubuntu 22.04 LTS and later releases by default; older releases are affected only if the Acquire::Retries setting is non-zero, a parameter that defaults to 3 from apt version 2.3.2 onwards.\n\n## Fixed versions and mitigation\n\n| Release | Fixed apt package |\n|---|---|\n| 26.10 | 3.3.3ubuntu0.1 |\n| 26.04 LTS | 3.2.1ubuntu0.1 |\n| 24.04 LTS | 2.8.4ubuntu0.1 |\n| 22.04 LTS | 2.4.15ubuntu0.1 |\n| 20.04 LTS | 2.0.12+esm1 (Ubuntu Pro) |\n| 18.04 LTS | 1.6.19+esm1 (Ubuntu Pro) |\n| 16.04 LTS | 1.2.36+esm1 (Ubuntu Pro + Legacy add-on) |\n| 14.04 LTS | 1.0.1ubuntu2.24+esm4 (Ubuntu Pro + Legacy add-on) |\n\nFor those unable to update immediately, a temporary mitigation is to set Acquire::Retries \"0\" in APT configuration and switch mirrors to HTTPS, which makes it harder for an attacker to inject the redirects necessary for the attack. This is not an isolated case: Justicz himself had already identified a similar APT redirect bug in 2019, tracked as CVE-2019-3462.\n\nFor users on Focal, Bionic, Xenial or Trusty, the patch is available only via Ubuntu Pro, which is free for up to five machines.