*** This bug is a security vulnerability ***
Public security bug reported:
Description:
On October 11, 2026, IANA executed a DNSSEC Key Signing Key (KSK)
rollover. systemd-resolved on Ubuntu 24.04 (and likely older releases)
relies on compiled-in/hardcoded KSK keys. Following this rollover,
Ubuntu 24.04 hosts configured with strict DNSSEC validation (DNSSEC=yes
in /etc/systemd/resolved.conf) can no longer resolve domain names.
Impact:
If a system relies on DNS resolution, this issue results in a complete
denial of service for DNS lookups. Crucially, because system updates
(via apt / unattended-upgrades) rely on DNS to reach package mirrors,
affected systems can no longer fetch updates automatically. Systems
relying on automatic security updates stop receiving updates entirely,
making this a critical issue.
Steps to Reproduce:
1. Enable DNSSEC validation in /etc/systemd/resolved.conf:
[Resolve]
DNSSEC=yes
2. Restart systemd-resolved:
sudo systemctl restart systemd-resolved
3. Query any domain using delv (from the bind9-utils package):
delv www.nntb.no
delv www.ietf.org
Expected Behavior:
DNS queries resolve and validate successfully.
Actual Behavior: Queries fail with a general failure error:
nornetpp@voksenkollen:~$ delv www.nntb.no
;; resolution failed: failure
nornetpp@voksenkollen:~$ delv www.ietf.org
;; resolution failed: failure
Workaround:
Create a local trust anchor override containing both KSK-2017 (20326)
and KSK-2024 (38696) keys, then restart systemd-resolved:
sudo mkdir -p /etc/dnssec-trust-anchors.d/
sudo tee /etc/dnssec-trust-anchors.d/root.positive << 'EOF'
. IN DS 20326 8 2
E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D
. IN DS 38696 8 2
683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16
EOF
sudo systemctl restart systemd-resolved
After updating the trust anchors, the DNSSEC resolution works again as
expected:
nornetpp@voksenkollen:~$ delv www.nntb.no
; fully validated
www.nntb.no. 101 IN CNAME webproxy.crnalab.net.
www.nntb.no. 101 IN RRSIG CNAME 13 3 300 20261013095304
20261011075304 34505 nntb.no.
VAV4zogBrarVjG/rKYnCrVl+pKYsbqeOcHzeV2a71UdTmgny3zKisReV
0dExXVsglFupkOOxe5lhT6EX4GbU9A==
webproxy.crnalab.net. 217 IN A 185.196.89.70
webproxy.crnalab.net. 217 IN RRSIG A 13 3 300 20261013095501
20261011075501 34505 crnalab.net.
0fYezWflkxfgE662J0Ox2oY7BKDJfKZ48HKIOoD0JpEVLeZU9VRLS5Id
Dt4gPBjlT+R4mKAWDC3brXHagcfzCQ==
nornetpp@voksenkollen:~$ delv www.ietf.org
; fully validated
www.ietf.org. 122 IN A 104.16.44.99
www.ietf.org. 122 IN A 104.16.45.99
www.ietf.org. 122 IN RRSIG A 13 3 300 20261013095326
20261011075326 34505 ietf.org.
3mVAB1OyJ9A3yetqrYEOWW76mh4Vvgqqwu50gB7JzsBaAVhzv8FTNHCd
aM8DHa3zRjPv0SIogMuRszod5aKgSQ==
Requested Action:
Ubuntu should provide an update of systemd-resolved as soon as possible!
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: systemd-resolved 255.4-1ubuntu8.17
ProcVersionSignature: Ubuntu 7.0.0-38.38~24.04.4-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Mon Oct 12 10:33:28 2026
InstallationDate: Installed on 2024-08-01 (802 days ago)
InstallationMedia: Kubuntu 24.04 LTS "Noble Numbat" - Release amd64 (20240425.1)
SourcePackage: systemd
UpgradeStatus: No upgrade log present (probably fresh install)
mtime.conffile..etc.systemd.resolved.conf: 2026-10-12T10:29:35.902627
** Affects: systemd (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble
** Information type changed from Private Security to Public Security
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170556
Title:
Critical: DNS resolution failure under Ubuntu 24.04 due to DNSSEC KSK
rollover
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2170556/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
