# CVE-2026-109518: APT RCE via hard link reuse

Status: published. Published: 2026-11-04. Updated: 2026-11-04.

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.



The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Debian / APT (apt): ≥ 0; < 1.2.36 (affected, dpkg); ≥ 1.4.0; < 1.4.12 (affected, dpkg); ≥ 1.6.0; < 1.6.19 (affected, dpkg); ≥ 1.8.0; < 1.8.2.4 (affected, dpkg); ≥ 1.8.3; ≤ 1.8.5 (affected, dpkg); ≥ 2.0.0; < 2.0.12 (affected, dpkg); ≥ 2.2.0; < 2.2.5 (affected, dpkg); ≥ 2.4.0; < 2.4.15 (affected, dpkg); ≥ 2.6.0; < 2.6.2 (affected, dpkg); ≥ 2.8.0; < 2.8.4 (affected, dpkg); ≥ 3.0.0; < 3.0.4 (affected, dpkg); ≥ 3.2.0; < 3.2.1 (affected, dpkg); ≥ 3.3.0; < 3.3.6 (affected, dpkg). Source: CNA: canonical
- Ubuntu / APT (apt): ≥ 0; < 1.0.1ubuntu2.24+esm4 (affected, dpkg); ≥ 1.2.0; < 1.2.36+esm1 (affected, dpkg); ≥ 1.6.0; < 1.6.19+esm1 (affected, dpkg); ≥ 2.0.0; < 2.0.12+esm1 (affected, dpkg); ≥ 2.4.0; < 2.4.15ubuntu0.1 (affected, dpkg); ≥ 2.8.0; < 2.8.4ubuntu0.1 (affected, dpkg); ≥ 3.2.0; < 3.2.1ubuntu0.1 (affected, dpkg); ≥ 3.3.0; < 3.3.3ubuntu0.1 (affected, dpkg). Source: CNA: canonical

## Severity and prioritization

- CVSS 4.0: 7.7 (high); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; source: CNA: canonical

- CVSS 4.0: 7.7 (high); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: security@ubuntu.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-62, CWE-367

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://lists.debian.org/debian-security-announce/2026/msg00526.html (CNA: canonical; vendor-advisory)

- https://ubuntu.com/security/notices/USN-8996-1 (CNA: canonical; vendor-advisory)

- https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html (ADP: CVE)

- https://lists.debian.org/debian-security-announce/2026/msg00526.html (security@ubuntu.com)

- https://ubuntu.com/security/notices/USN-8996-1 (security@ubuntu.com)

- https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html (af854a3a-2127-422b-91ae-364da2661108)

## Provenance

- CNA: canonical: https://www.cve.org/CVERecord?id=CVE-2026-109518; retrieved 2026-11-04; source updated 2026-11-04

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109518; retrieved 2026-11-04; source updated 2026-11-04

Revision: 85b353b04e0913a72d7b9510aa8859ddbfd1051528ee549d5cbab785545eb78b

Canonical: https://y2.dev/cve/CVE-2026-109518

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.