Urgent Security Update | APT Download Verification Bypass — Please Update Now

Key points

deepin has released a fix for CVE-2026-109518, a flaw in APT that lets a network-positioned attacker swap an already verified package for another one, which is then installed with root privileges. All deepin 25 users are asked to update to apt 2.8.4deepin1 as soon as possible.

The vulnerability

• CVE-2026-109518 is rated High, with a CVSS v4.0 score of 7.7, and was reported by Max Justicz.
• While following an HTTP redirect, APT can merge two separate package downloads into one target file.
• If that download is retried or resumed, a hard link is reused incorrectly, leaving a time-of-check to time-of-use (TOCTOU) gap between verification and installation.
• The replacement package does not need a valid signature, so the package that gets installed can differ from the one that was checked.
• No exploitation in the wild has been reported so far.

Conditions for an attack

• The attacker must be on the network path: the same LAN, a rogue proxy or a compromised mirror.
• The repository must be fetched over HTTP with redirects followed.
• Acquire::Retries must be set to a non-zero value.

Who is affected

• Every deepin 25 system that has not yet installed this update.

What the fix changes

• apt is updated to 2.8.4deepin1, which carries the upstream security update.
• Download methods now open target files exclusively (O_EXCL), so two downloads cannot end up in the same file.
• Five out-of-bounds access issues are fixed in the same update.
• deb: protection against an unsigned underflow when trimming control newlines.
• gpgv: PushEntryWithKeyID no longer advances past the null terminator.
• debDebFileParser: .deb packages without a Version field are rejected.
• srvrec: res_query answers larger than the buffer are rejected.
• tagfile: the unbounded backward scan in the trailing-newline check of Fill() is fixed.

How to update

• Update through Control Center, or run the following in a terminal:

sudo apt update && sudo apt dist-upgrade

• Then check the installed version, which should be 2.8.4deepin1:

apt --version

• No reboot is needed.

Caveats and temporary mitigation

• The patched apt is itself downloaded by the old, vulnerable version, so deepin recommends doing this update from a trusted network.
• If you cannot update right away, disabling download retries removes one of the required conditions:

sudo apt -o Acquire::Retries=0 update

• This is only a stopgap and does not replace installing the update.

Summary by DistroNews, based on the original post.