Ubuntu LTS point releases proposed over critical APT flaw

A contributor on the Ubuntu Discourse has called for emergency point releases of Ubuntu 22.04 LTS and 24.04 LTS after disclosure of CVE-2026-109518, a critical race condition in APT that can let an attacker replace a verified package with a malicious one.

CVE-2026-109518 is a time-of-check-to-time-of-use flaw in APT’s HTTP transport during download retries. A rogue mirror or man-in-the-middle can swap a legitimate .deb after signatures and hashes are checked but before the package is unpacked. Because APT runs as root, the result is arbitrary code execution.

Security updates already address systems that are online and pulling patches. The proposal argues that is not enough for new deployments. Current installation media and cloud images still ship with retries enabled by default, so the first apt update and upgrade on a fresh system remains exposed. That window matters for auto-scaling cloud instances, CI pipelines, containers, and environments that boot from local or caching mirrors before they ever receive the fixed APT.

The suggested remedy is to freeze the Jammy and Noble package sets, integrate the patched APT, and publish new point-release ISOs and images so the bootstrap path itself is trustworthy again. The post also references a related 26.04.2 consideration in the same request.

Whether Canonical will cut 22.04.6 and 24.04.6 on that basis remains a decision for the release team.