Debian and Ubuntu APT Security Update Advisory (CVE-2026-109518)
Nov 06 2026
A security update has been released to address a UNIX hard link vulnerability (CVE-2026-109518) in APT (the package management tool) for Debian and Ubuntu. – This vulnerability affects multiple versions of APT, and the range of vulnerable versions has been specified for both Debian and Ubuntu.
For Debian: versions prior to 1.2.36, versions 1.4.0 through 1.4.12, versions 1.6.0 through 1.6.19, versions 1.8.0 through 1.8.2.4, and versions 1.8.3 or higher but no later than 1.8.5, 2.0.0 or higher but less than 2.0.12, 2.2.0 or higher but less than 2.2.5, 2.4.0 or higher but less than 2.4.15, 2.6.0 or higher but less than 2.6.2, 2.8.0 or higher but less than 2.8.4, 3.0.0 or higher but less than 3.0.4, 3.2.0 or higher but less than 3.2.1, and 3.3.0 or higher but less than 3.3.6.
For Ubuntu, versions 1.0.1ubuntu2.24+esm4 or lower, 1.2.0 or higher but less than 1.2.36+esm1, 1.6.0 or higher but less than 1.6.19+esm1, 2.0.0 or higher but less than 2.0.12+esm1, 2.4.0 or higher but less than 2.4.15ubuntu0.1, 2.8.0 or higher but less than 2.8.4ubuntu0.1, 3.2.0 or later but less than 3.2.1ubuntu0.1, and 3.3.0 or later but less than 3.3.3ubuntu0.1.
Patches have been provided via the latest updates; for Debian, this applies to versions 1.2.36 or higher, 1.4.12 or higher, 1.6.19 or higher, 1.8.2.4 or higher, 2.0.12 or higher, 2.2.5 or higher, 2.4.15 or higher, 2.6.2 or higher, 2.8.4 or higher, 3.0.4 or higher, 3.2.1 or higher, and 3.3.6 or higher are the fixed versions.
For Ubuntu, the fixed versions are 1.0.1ubuntu2.24+esm4 or later, 1.2.36+esm1 or later, 1.6.19+esm1 or later, 2.0.12+esm1 or later, 2.4.15ubuntu0.1 or later, 2.8.4ubuntu0.1 or later, 3.2.1ubuntu0.1 or later, and 3.3.3ubuntu0.1 or later are the fixed versions.
