CVE-2026-82474

A flaw was found in Sudo. This vulnerability allows users who are permitted to run specific commands to bypass security policy checks when using the execveat system call in ptrace-based intercept mode. By directly calling execveat or fexecve, an attacker can execute programs that would otherwise be denied, thereby circumventing policy enforcement and logging mechanisms.

This vulnerability in Sudo allows a local attacker, already authorized to run specific commands, to bypass configured policy restrictions. By directly invoking execveat or fexecve when Sudo is operating in ptrace-based intercept mode, an attacker can execute programs otherwise denied by sudo policies. This undermines granular access control and could lead to unauthorized command execution on affected Red Hat systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the ptrace-based intercept mode in the sudoers configuration. Add Defaults !intercept to /etc/sudoers or a file within /etc/sudoers.d/. This action may affect advanced sudo policy enforcement or logging features that rely on ptrace-based interception. Always validate sudoers file changes with visudo to prevent system lockout.