CVE-2026-82474 was published on 29 August 2026. Sudo through 1.9.17p2 skips intercept policy checks for the execveat system call when running in ptrace-based intercept mode, so a user allowed to run specific commands can launch denied programs and avoid the log entry. Ubuntu released fixed packages on 22 September 2026 as USN-8803-1.
This only matters on hosts where sudoers turns on intercept. Plain sudo rules without it are not what this bug targets.
What's affected
- Upstream: sudo 1.9.17p2 and earlier. The sudo project fixed it in a commit titled "Add intercept and log_subcmds support for execveat(2)". The sudo stable releases page still listed 1.9.17p2 as current when this was written, so use your distribution's package until a new upstream release appears.
- Ubuntu 24.04 LTS: fixed in 1.9.15p5-3ubuntu5.24.04.3.
- Ubuntu 26.04 LTS: fixed in 1.9.17p2-1ubuntu3.1.
- Severity: CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L with high impact on confidentiality, integrity and availability. It is local only and needs an account that can already run some commands through sudo.
Per the upstream commit, sudo had always allowed execveat(2) in intercept mode so its own fdexec feature could use fexecve(3). The fix resolves the file descriptor to a path through /proc so sudoers rules can match it.
What to do now
- Find hosts that use intercept:
sudo grep -rnE "intercept|log_subcmds" /etc/sudoers /etc/sudoers.d/. No match means this CVE is not in play for that host. - On Ubuntu, update:
sudo apt update && sudo apt install --only-upgrade sudo, then confirm withsudo -V | head -1. - On other distributions, search their tracker for CVE-2026-82474 and take the vendor package. Do not infer from the upstream version number alone.
- Where intercept is the only control keeping a user away from certain binaries, add a second control such as AppArmor, SELinux or a restricted shell, since policy by path is easy to route around.
Quick check
Does every sudo install need an emergency patch for this?
No. It affects ptrace-based intercept mode. Hosts that never enable intercept or log_subcmds are not exposed to this specific bug, though updating is still sensible.
