Ubuntu’s APT Security Fix: Check the Installed Package Before Calling It Done

Running apt update refreshes Ubuntu’s package lists. It does not install the APT security fix Canonical published on November 4. For CVE-2026-109518, the useful check comes after installation: does this machine have the corrected APT package revision for its own Ubuntu release?

The distinction matters because APT is also underneath graphical package tools. Switching from apt-get to a desktop updater does not avoid the affected library. Canonical says Snap installations use a different system and are outside this vulnerability’s scope.

What makes the vulnerable download dangerous

Canonical’s advisory describes an attacker who can manipulate HTTP traffic between the computer and its package archive, or control a malicious mirror. A flaw involving redirects, hard links and retried downloads could allow an unverified package to be installed. Package scripts can then run with root privileges.

The attack needs a failed download to be retried. Ubuntu 22.04 LTS and newer releases enable a nonzero Acquire::Retries value by default; older releases are affected only if that setting has been changed to a nonzero value. That is a configuration distinction, not a reason to leave an older machine unpatched.

Match the fix to the release

Ubuntu Security Notice USN-8996-1 lists these corrected APT versions for releases receiving standard support:

• Ubuntu 22.04 LTS: 2.4.15ubuntu0.1.
• Ubuntu 24.04 LTS: 2.8.4ubuntu0.1.
• Ubuntu 26.04 LTS: 3.2.1ubuntu0.1.
• Ubuntu 26.10: 3.3.3ubuntu0.1.

Use the row for the installed release. A 24.04 machine does not need the 26.10 package, and obtaining this fix does not require a distribution upgrade. Ubuntu’s revision suffix is part of the version to compare.

Install with retries disabled, then verify

1. Record the installed packages built from the APT source:

apt list --installed '?source-package(^apt$)'

2. Canonical recommends refreshing the lists and upgrading packages with download retries temporarily disabled:

sudo apt update && sudo apt upgrade -o Acquire::Retries=0

3. Review the proposed package changes before accepting them. After the command finishes, run the inventory command again and compare the results with the corrected versions for your release.

The -o option applies to that command. It does not ask you to permanently edit APT’s global configuration. If a full package upgrade cannot be arranged, Canonical also documents this targeted alternative:

sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'

An error is a reason to investigate

If refreshing the lists fails, resolve the repository or connectivity error before treating the update as complete. HTTPS protects against manipulation along the network path, but changing a mirror’s address blindly can introduce another failure: some community mirrors do not support HTTPS. Canonical still recommends installing the fixed packages.

Older releases need the appropriate security coverage. The notice marks Ubuntu 20.04 and earlier fixes as Ubuntu Pro packages; Canonical specifies ESM for 20.04 and 18.04, and ESM plus the Legacy add-on for 16.04 and 14.04.

Our Ubuntu PHP update guide makes a related point about checking distribution package revisions. Here, start with APT itself: successful list retrieval and a completed security-package installation are two different results.