Retry settings decide who is exposed
The vulnerability depends on APT’s Acquire::Retries setting being non-zero. APT developers say this has been the default since version 2.3.2, although scripts may have enabled retries on older installations. Ubuntu specifies that the default retry value of three applies from Debian 12 (Bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish) onward. Older releases are not exposed by default, but may still be vulnerable if retries have been enabled.
Debian 13 (Trixie) is patched in APT 3.0.4, while Debian 12 (Bookworm) received the fix in version 2.6.2. Ubuntu has also released patched packages for supported releases, including 22.04 LTS, 24.04.LTS, and 26.04 LTS. Ubuntu 26.10 was also affected, with its fix being published when Ubuntu’s November 4 advisory appeared. The fix addresses the underlying file-handling issue. In a commit authored on October 12, APT developer Julian Andres Klode changed the download code to open destination files exclusively, unlinking existing files before copying over any partially downloaded content.
The change prevents downloads from writing through existing hard links, which could otherwise redirect writes to unintended files.
