CVE-2026-109518— APT RCE via hard link reuse

Quick assessment

Affected

Debian APT

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Debian、Ubuntu 及其衍生 Linux 发行版中，若攻击者位于通信路径上（on-path），能够操纵 APT 客户端与归档服务器之间的 HTTP 流量（例如通过恶意镜像站或代理），并在触发软件包安装时介入，则可诱骗客户端安装由攻击者控制且未经验证的软件包，从而实现以 root 权限执行的远程代码执行。该漏洞的成因在于硬链接（hard link）的复用，且需要客户端遵循重定向并重新下载软件包文件。此外，客户端必须配置了非零的参数；自 Debian 12（bookworm）和 Ubuntu 22.04

CVSS 7.7 · High Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1059.004 · Unix Shell T1190 · Exploit Public-Facing Application

Affected Version Matrix 21

Vendor	Product	Version Range	Status
Debian	APT	`< 1.2.36`	affected
		`1.4.0< 1.4.12`	affected
		`1.6.0< 1.6.19`	affected
		`1.8.0< 1.8.2.4`	affected
		`1.8.3≤ 1.8.5`	affected
		`2.0.0< 2.0.12`	affected
		`2.2.0< 2.2.5`	affected
		`2.4.0< 2.4.15`	affected
… +5 more rows
Ubuntu	APT	`< 1.0.1ubuntu2.24+esm4`	affected
		`1.2.0< 1.2.36+esm1`	affected
		`1.6.0< 1.6.19+esm1`	affected
		`2.0.0< 2.0.12+esm1`	affected
		`2.4.0< 2.4.15ubuntu0.1`	affected
		`2.8.0< 2.8.4ubuntu0.1`	affected
		`3.2.0< 3.2.1ubuntu0.1`	affected
		`3.3.0< 3.3.3ubuntu0.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

APT RCE via hard link reuse

Source: CVE Program / CVE List V5

Vulnerability Description

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

UNIX硬链接

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Debian	APT	0 ~ 1.2.36	-
Ubuntu	APT	0 ~ 1.0.1ubuntu2.24+esm4	-

II. Public POCs for CVE-2026-109518

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-109518

请登录查看更多情报信息。

Other References for CVE-2026-109518 (2)

https://ubuntu.com/security/notices/USN-8996-1 vendor-advisory
https://lists.debian.org/debian-security-announce/2026/msg00526.html vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-109518

IV. Related Vulnerabilities

Same product: APT

Same vendor: Debian

Same weakness: CWE-62