News › linux
By The Linux Camp News, October 17, 2026
The maintenance release adds hardware support and a newer Morph Browser engine. Its security fix restricts access to a root-running download service, while upgrades from 24.04-1.4 require an intermediate release.
UBports released Ubuntu Touch 24.04-2.1 on 16 October 2026, alongside 24.04-1.5 for the older maintenance branch. Both include a security fix for applications gaining privileges without a password; 24.04-2.1 also expands hardware support and updates Morph Browser. The announcement retrieved on 17 October describes availability over the coming days, rather than a completed rollout to every supported device. 3 2 1
The support additions include Nothing Phone (1), Volla Tablet, Xiaomi Redmi Note 9 Pro (Global), Redmi Note 9S/9 Pro (India), Redmi Note 9 Pro Max and Poco M2 Pro. Morph moves to QtWebEngine 6.11.2, which UBports describes as Chromium 140 plus security fixes, following the Chromium 134 engine in 24.04-2.0. The announcement also calls OnePlus Nord N10 and N100 additions, although the preceding release already listed Nord N10 5G and N100. Their status as newly supported hardware is therefore unclear. 2 4 1
The security problem is a privilege-boundary failure in lomiri-download-manager. Its system-bus instance runs as root for system services, while its user-bus instance runs as the logged-in user for applications. D-Bus policy controls access to these service interfaces. The incorrect policy let arbitrary users reach the root-running instance instead of being limited to their own privileges. Because the download manager supports executing commands after a download, that access became a route to root command execution, identified as CVE-2026-96425. 3 5 1
Exposure depends on application confinement, not simply on having Lomiri installed. UBports says most Ubuntu Touch applications are restricted by AppArmor and cannot exploit this vulnerability; it expects applications on other Lomiri distributions to be more commonly unconfined. The official CVE record retrieved on 17 October lists upstream lomiri-download-manager versions from 0.1.0 through versions below 0.3.3 as affected. For operators, the relevant distinction is whether an application can reach the privileged service, rather than whether downloads themselves are trusted. 3 5
The repair has two layers: D-Bus policy blocks arbitrary users from the system-level download and upload services, and the system-level download manager no longer accepts post-download commands as defense in depth. The second change removes the dangerous operation even beyond the access restriction. As retrieved on 17 October, UBports lists lomiri-download-manager 0.3.3 and Ubuntu Touch 24.04-2.1 and 24.04-1.5 as fixed versions. 3
Severity assessments differ. In the material retrieved on 17 October, UBports labels its advisory High, while the official CVE record assigns CVE-2026-96425 a CVSS 3.1 score of 5.5, Medium. Those are assessments, not evidence of attacks. The CISA catalog snapshot dated 16 October and retrieved on 17 October does not list this CVE; that absence does not establish that exploitation has not occurred. 3 5 6
Check the device's starting release before planning the transition. UBports requires devices running 24.04-1.4 to install 24.04-1.5 before attempting 24.04-2.1, even if the newer branch is offered prematurely: unsynchronized pre-upgrade checks can otherwise prevent progress. For other Lomiri distributions, UBports recommends download-manager 0.3.3 or newer, or a distribution-patched package. That alternative matters when checking package inventory: an older upstream version label alone does not rule out a vendor fix. 2 3
There are two important limits to this release assessment. UBports reports a small number of Morph launch failures after upgrades from 24.04-1.5 or earlier to 24.04-2.0 or later; its release notes provide a workaround but defer a complete fix to a subsequent update. Separately, the retrieved security-advisory page displays a deleted-topic notice despite containing the advisory text. Its public availability is therefore uncertain, although the official CVE record independently confirms the incorrect D-Bus policy and root-command consequence. 2 3 5