Back to Security Advisories

APT Vulnerability — Ubuntu Security Update (USN-8996-1)

USN-8996-1 fixes CVE-2026-109518 in APT on Ubuntu: APT mishandled hard links when encountering redirects and retrying package downloads, letting a remote on-path attacker trick APT into installing an unverified package and run programs as administrator (CVSS 7.7, CWE-62). Update: sudo apt update && sudo apt upgrade apt and restart any running package operations.

Critical 7.7 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

APT runs as root on every Ubuntu server — an on-path attacker (malicious network, compromised mirror) who slips in an unverified package during a retry gains root execution on the target machine.

Type:

security

Severity:

important

Release date:

2026-11-04

Description:

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-85049)
* chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability (CVE-2026-91747)
* chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation (CVE-2026-91733)
* chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia (CVE-2026-91740)
* chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation (CVE-2026-93387)
* chromium-browser: skia: chromium-browser: Uninitialized resource in Skia (CVE-2026-102325)
* chromium-browser: skia: Integer overflow in Skia (CVE-2026-103629)
* chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-106379)
* chromium-browser: skia: Out of bounds read in Skia (CVE-2026-106399)
* chromium-browser: skia: Memory corruption in Skia (CVE-2026-113106)
* chromium-browser: skia: Improper input validation in Skia (CVE-2026-118348)
* chromium-browser: skia: Memory corruption in Skia (CVE-2026-118351)
* chromium-browser: skia: Memory corruption in Skia (CVE-2026-118340)
* chromium-browser: skia: Improper input validation in Skia (CVE-2026-118354)
* chromium-browser: skia: Memory corruption in Skia (CVE-2026-118319)
* chromium-browser: skia: Use after free in Skia (CVE-2026-119271)
* chromium-browser: skia: Improper input validation in Skia (CVE-2026-119261)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 webkit2gtk3-jsc-devel-2.54.2-0.el9_8.2.aarch64.rpm 62060a3380692181b4d07fd56c56a599dddf1bbf43f5192c2795044a53b15b9e
aarch64 webkit2gtk3-devel-2.54.2-0.el9_8.2.aarch64.rpm 96914fca4867044857088d82f925a9df0c21ecccfd95b126e1e9eb70e791524f
aarch64 webkit2gtk3-jsc-2.54.2-0.el9_8.2.aarch64.rpm bbd89f4cf54f0d4f16493d5ef0daab600420f147b89fab2fe3e74eb85f0bd7b3
aarch64 webkit2gtk3-2.54.2-0.el9_8.2.aarch64.rpm eea7d907feff1ef22293f177f51d0ea170459f8f181395d4dd66e80033a5e6de
i686 webkit2gtk3-devel-2.54.2-0.el9_8.2.i686.rpm 1c0791f307fb42ae6429c78e92fed94d03b40e093c80b5834629a9e78cb98fbb
i686 webkit2gtk3-jsc-devel-2.54.2-0.el9_8.2.i686.rpm 358d78bf2a6a94d38b5e1ebec4f5eeab51a2d829ee381aeffa51a391e6183af9
i686 webkit2gtk3-jsc-2.54.2-0.el9_8.2.i686.rpm 93dbae65abd6cb01471b5c43b4c29939eba14320b6bff1860643d2ac0d04ea22
i686 webkit2gtk3-2.54.2-0.el9_8.2.i686.rpm ffb67bf9d3df48767b8f0764e5f0d2fb21b2e7640f974f66f95957003e75403b
ppc64le webkit2gtk3-jsc-devel-2.54.2-0.el9_8.2.ppc64le.rpm 1753e93579f39fb3bfb1efeaab09438d00bae942f30176b7c88b7d912aab8a27
ppc64le webkit2gtk3-2.54.2-0.el9_8.2.ppc64le.rpm d62a36af50a0fd3827579de7b9dfec194234b425d96c380a65c1fcb7ff8b4b94
ppc64le webkit2gtk3-jsc-2.54.2-0.el9_8.2.ppc64le.rpm d66284386621baa9419c0d9cefb69d6ce942c97f350cfb83d1f478f1f5ba0414
ppc64le webkit2gtk3-devel-2.54.2-0.el9_8.2.ppc64le.rpm e2579d5008a3f0067a7aba44adc936369198d9a6a1a8f3f7dcb8eeb7446d6a45
s390x webkit2gtk3-jsc-2.54.2-0.el9_8.2.s390x.rpm 43b1fe344e96c0b228e64f5cd71ee3cdaf788d8d1c8f6fd7941bb8091d065241
s390x webkit2gtk3-devel-2.54.2-0.el9_8.2.s390x.rpm c59d8965a51ea0693be0ef9a7413800aacf910c838d2dc7c81dda7bd9667c8fc
s390x webkit2gtk3-jsc-devel-2.54.2-0.el9_8.2.s390x.rpm df6a74b4cac61422ee0cd340c8bb824713f24c1f5c9cca9b13870d6338dc7f36
s390x webkit2gtk3-2.54.2-0.el9_8.2.s390x.rpm f84eade393d7b54a07fc4e57c9bead76159f66a2f95d12a027fe2d9702ae6f2a
x86_64 webkit2gtk3-jsc-2.54.2-0.el9_8.2.x86_64.rpm 17dcaf3d82373ba702ebd5da02e8231a12811d3a8b5038661c7b40eacd261ab9
x86_64 webkit2gtk3-2.54.2-0.el9_8.2.x86_64.rpm 4dc263b3c06df46572766a5d0264c71c3b8c9c2c7a08d554e415648c0663b436
x86_64 webkit2gtk3-jsc-devel-2.54.2-0.el9_8.2.x86_64.rpm 8a6371cf74a0ae308a0a67c1e4e9b5b17f64e10b24e72fe0487d205e397c0e70
x86_64 webkit2gtk3-devel-2.54.2-0.el9_8.2.x86_64.rpm fc72962c96c867c4f89f0ac316201ac164819cdff08c53e85d5bb669ef2ab3f5

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is CVE-2026-109518?
It is a flaw in APT's handling of hard links during redirects and download retries: an on-path attacker can trick APT into installing an unverified package, which then runs as administrator. CVSS 7.7, CWE-62; fixed in USN-8996-1 (November 4, 2026).
Who is affected?
Ubuntu systems running apt over networks the attacker can influence — public Wi-Fi, compromised mirrors, or any on-path position between the server and its package source.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade apt (a small, quick update), then re-run any interrupted upgrades. Prefer HTTPS-based mirrors and trusted networks for package traffic as defense in depth.
Was this exploited?
No exploitation is reported in the notice. The risk is positional — it requires an on-path position — but package managers run as root, so the update belongs in every server's immediate batch.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System