Ubuntu issued a libpcap security update today, for a flaw in the packet-capture library used by many network tools. Canonical says specially crafted data could crash an application that relies on libpcap. The notice covers supported Ubuntu LTS releases, with different package paths for standard and extended security maintenance.
What Ubuntu’s libpcap notice says
Ubuntu Security Notice USN-8824-1 identifies CVE-2026-0799. Canonical says libpcap failed to validate some Berkeley Packet Filter instructions correctly. In certain circumstances, an attacker could cause out-of-bounds memory operations. The public notice describes an application crash as the practical risk. It does not claim that every packet-capture session leads to compromise.
Libpcap sits beneath tools that read or capture network traffic. An administrator may use it indirectly without ever invoking the library by name. That is why this update matters beyond the small group who develop packet-capture software.
Which Ubuntu releases have fixes?
The September 25 notice lists Ubuntu 26.04 LTS, 24.04 LTS and 22.04 LTS, plus older LTS versions covered through Ubuntu Pro or Legacy Support. For the three recent releases, Canonical lists these corrected packages:
- Ubuntu 26.04 LTS:
libpcap0.8t64version1.10.6-1ubuntu1.1. - Ubuntu 24.04 LTS:
libpcap0.8t64version1.10.4-4.1ubuntu3.1. - Ubuntu 22.04 LTS:
libpcap0.8version1.10.1-4ubuntu1.22.04.2.
Older releases have separate ESM versions in the advisory. Do not assume a package meant for 24.04 belongs on a 22.04 machine. Check the release and its configured repositories before comparing version strings.
How administrators can apply the update
Use the normal package channel
Canonical says a standard system update makes the needed change. Run sudo apt update and then sudo apt upgrade on an affected machine. Check the installed version with apt policy libpcap0.8t64 on 24.04 or 26.04, or apt policy libpcap0.8 on 22.04. Verify that the candidate package comes from the expected Ubuntu repository.
If a network diagnostic application was already open, restart it after the library update so it loads the patched code. Our Wireshark on Ubuntu guide covers one common packet-analysis workflow. The guide is useful for identifying the tool; the security fix itself comes through Ubuntu’s package update.
For systems on older LTS releases, confirm Ubuntu Pro or Legacy Support eligibility in the advisory. Keep a record of the installed package version, especially on machines where packet captures come from untrusted networks.
Teams that automate packet inspection should check scheduled jobs as well as interactive desktops. A job may keep an older process running after the package is replaced. Restart the service during a maintenance window, then repeat a normal capture test. That confirms both that the application still works and that the patched library is in use.