CVE-2026-109518

In Red Hat deployments, this vulnerability is evaluated with an Important impact because an on-path adversary could achieve full administrative takeover by tampering with package downloads, an outcome warranting an Important rating over Moderate despite requiring active traffic interception. Red Hat Enterprise Linux and supported platforms natively utilize RPM and DNF rather than APT for software packaging and system management. As the APT package manager is neither shipped nor supported in standard Red Hat environments, typical installations do not expose this package retry functionality.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

--- CME Mitigation Guidance (2026-11-06) ---

Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to eliminate unverified package substitution by disabling download retries in apt configuration or securing repository transport: upgrade to APT 2.6.2 / 3.0.4 (or the fixed Apt builds), which correct file handling and link management when resuming redirected downloads to prevent unverified file substitution, closing all 2 injection vectors (HTTP redirect injection during package download retries, package file substitution via reused hard links upon download resumption). Until patched, this is only a concern on Debian, Ubuntu, and derivative Linux systems running APT with Acquire::Retries set to a non-zero value — Standard Red Hat environments using RPM and DNF rather than APT are unaffected — so Set Acquire::Retries 0 in apt.conf to prevent download resumption and avoid untrusted mirrors or unencrypted network paths. As a compensating measure, Configure auditd to monitor unexpected hard link creation and unauthorized process execution during package installs, Deploy IPsec or WireGuard to encrypt repository traffic and prevent on-path redirect injection during retries, Maintain SELinux in enforcing mode to confine package installation processes and post-install maintainer scripts, and Enable IMA/EVM appraisal to verify cryptographic integrity and block execution of unsigned substituted binaries. These controls limit blast radius and contain exploitation, but they do not fix the underlying insecure hard link reuse defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-204 IPsec / WireGuard (Encrypted Transport) (medium)