UBports released Ubuntu Touch 24.04-2.1 and 24.04-1.5, headlined by a security patch that plugs a flaw letting unconfined apps gain root access without a password. The update adds eight new supported phones, including the Nothing Phone (1), OnePlus Nord models, and several Xiaomi Redmi Note and Poco devices. Morph Browser gets an engine bump to QtWebEngine 6.11.2 on Chromium 140, along with fixes for tab-switch jank, push notifications, and timezone display. Existing users can install via System Settings => Updates, though some devices on 24.04-1.4 should update to 24.04-1.5 first.
UBports ships Ubuntu Touch maintenance updates with a security patch and eight new phones
UBports released two coordinated updates to Ubuntu Touch, and the one you should actually care about is a security fix for a flaw that let any app take root on your device without a password. The two releases, Ubuntu Touch 24.04-2.1 and 24.04-1.5, also widen support with eight new phones, bring a newer Morph Browser, and quietly patch a pile of daily-driver bugs on the community OS that has outlived its corporate parent.
Both went out over the following days through the on-device updater, with start times assigned at random. That's not a bandwidth tactic. UBports said the staggered timing gives its team a breathing space to stop the rollout of a bad update should that ever become necessary.
A root-access hole, patched
Here's the part worth your attention. The advisory lists two related flaws: CVE-2026-96425 in lomiri-download-manager and CVE-2026-96424 in lomiri-upload-manager. Both fall under CWE-732, which is permission assignment for a critical resource gone wrong, and both were rated High severity.
The two managers run as D-Bus daemons on two buses at once. The system-bus instance runs as root and serves system services, while the user-bus instance runs as you and serves regular apps. A misconfigured policy let an app reach the system instance anyway. In the download manager that meant running arbitrary commands once a download finished. In the upload manager it meant reading any file on the device and sending it somewhere the attacker chose.
Not every app could pull this off. Most Ubuntu Touch apps are tucked inside AppArmor confinement, which blocks the exploit. The real risk landed on unconfined apps, usually sideloaded or developer-installed software rather than OpenStore packages. The advisory was candid about the gap, pointing out that on other Lomiri distributions most apps are likely unconfined and therefore far more exposed.
Affected versions ran from everything up through lomiri-download-manager 0.3.2, plus Ubuntu Touch 24.04-1.4 and 24.04-2.0. The fix locked down those system daemons with a proper D-Bus policy and disabled the post-download command on the root instance as a second layer of defense.
Don "Jake" Ellestad reported the first issue on 6 August, with the upload manager following two days later. Maciej Sopyło, known in the community as @NotKit, did the patching. The fix shipped in lomiri-download-manager 0.3.3 on 13 September, and the 16 October release came "coordinated with the publication of this advisory." UBports didn't mince words: "All users are recommended to update as soon as possible."
New devices, a faster browser, and the smaller release
On top of the security work, 24.04-2.1 is the release most people will notice for hardware. It adds eight devices to the supported list, all in the budget-to-midrange slice where Ubuntu Touch has always wanted a foothold. The new lineup: Nothing Phone (1), OnePlus Nord N10, OnePlus Nord N100, Volla Tablet, Xiaomi Redmi Note 9 Pro (Global), Xiaomi Redmi Note 9S/9 Pro (India), Xiaomi Redmi Note 9 Pro Max, and Xiaomi Poco M2 Pro. That's a lot of Redmi and Nord devices, exactly the families common in emerging markets and thus the audience this OS has always been trying to reach.
Morph Browser, the default web browser, got an engine bump to QtWebEngine 6.11.2 based on Chromium 140, along with its own security fixes. The user-facing changes are smaller than the version number implies. It fixed tab-switch jank by stopping the double-grab of full-resolution previews, and it restored user-script support that had quietly regressed during the move to QtWebEngine 6.
A handful of other fixes rounded out the release. The mouse-pointer confinement bug that pinned the cursor during screen rotation is gone, which helps Volla Tablet users with the keyboard cover. The flashlight now toggles on the Volla Phone Plinius. Push notifications are more reliable in a few scenarios, a fix shared with the 1.5 release. The status-indicator timezone was sometimes wrong and is now right. And the on-screen keyboard for Libertine apps is working again, restoring the subsystem that runs traditional desktop X11 software.
Waydroid, the container that lets Ubuntu Touch run Android apps, jumped to v1.6.3 with patches for Android 16, while QtMir picked up better multi-window handling and Halium 15+ detection.
Ubuntu Touch 24.04-1.5 covers the handful of devices still on the older 24.04-1.x line. Its scope is narrower on purpose. It carries the same security fixes plus the shared batch of bug fixes, but no new devices and no Morph Browser update, both of which stayed on the 2.x line. That's by design, not oversight. UBports notes that only fixes for regression, critical, and security issues enter a late 1.x release, with everything else waiting for the next major update.
Two known headaches ride along with the whole rollout. First, a small number of users found Morph Browser would not launch after jumping from 24.04-1.5 or earlier straight up to 24.04-2.0 or later. A complete fix is coming next time, but in the meantime UBports published a workaround you can run through the Terminal, ADB, or SSH:
sudo sh -c 'rm -vf /var/cache/apparmor/*/usr.bin.morph-browser*' sudo apparmor_parser --replace /etc/apparmor.d/usr.bin.morph-browser
Enter your lock screen PIN or passphrase if it asks for one. Second, Pixel 3a and 3a XL users may hit a race condition where the next upgrade fails right after a reboot, though it usually succeeds on a fresh try. If it keeps failing, UBports says to use the UBports Installer to restore the device. This wasn't a surprise in hindsight, given the call-for-testing thread showed 24.04-1.5 cycling through multiple release candidates, with Pixel 3a SMS, battery, and voice-volume regressions pushing the final date several times before launch.
Existing users get the update through System Settings > Updates. Devices on 24.04-2.0 go to 24.04-2.1, and those on 24.04-1.4 go to 24.04-1.5. Wait for your device to be offered the update, which may take a bit given the random timing. If you want it immediately, you can enable ADB and run system-image-cli directly. One trap to avoid: devices on 24.04-1.4 should hit 24.04-1.5 first before attempting the jump to 24.04-2.x. UBports warned that such devices can be offered 24.04-2.1 prematurely, and that early upgrade can fail because the pre-upgrade check hasn't caught up. Just wait for 1.5 and retry. Fresh installs live at devices.ubuntu-touch.io, with a guided installer. Head there for the install wizard.
It's worth keeping perspective. The move to the Ubuntu 24.04 LTS base in October 2025 was a genuinely generational step for the project, and these two releases read as the maintenance polish that follows a foundation like that. It's a serious privilege-escalation hole closed, real hardware support added, and a modern browser engine in place, on a team funded by donations rather than a corporate sponsor. Whether this is enough to tempt you away from the Android and iOS duopoly is another question, but for anyone tracking this project it's further evidence that it keeps moving, one maintenance release at a time.
Head here to the official announcement.
