Description
A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift AI 3.0 | — | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — | — |
| Red Hat | Red Hat Update Infrastructure 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sudo | 1.9.17p2-9 | — |
| Debian 13 | sudo | No fix yet | — |
| Debian 12 | sudo | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | sudo | 1.9.17p2-1ubuntu3.2 | USN-8895-1 |
| Ubuntu 24.04 LTS | sudo | 1.9.15p5-3ubuntu5.24.04.4 | USN-8895-1 |
| Ubuntu 22.04 LTS | sudo | 1.9.9-1ubuntu2.7 | USN-8895-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | sudo | No fix yet | — |
| Ubuntu Pro 18.04 LTS | sudo | No fix yet | — |
| Ubuntu Pro 16.04 LTS | sudo | No fix yet | — |
| Ubuntu Pro 14.04 LTS | sudo | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | sudo +1 | 1.9.17-10.p2.el10_2.7 | RHSA-2026:75579 |
| RHEL 9 | sudo +1 | 1.9.17p2-3.el9_8.3 | RHSA-2026:75571 |
| RHEL 8 | sudo | 1.9.5p2-2.el8_10 | RHSA-2026:75580 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | sudo +3 | 1.9.17-16.p2.2.hum1 | RHSA-2026:71609 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | sudo +1 | 1.9.17-10.p2.el10_2.7 | ALSA-2026:75579 |
| AlmaLinux 9 | sudo +1 | 1.9.17p2-3.el9_8.3 | ALSA-2026:75571 |
| AlmaLinux 8 | sudo | 1.9.5p2-2.el8_10 | ALSA-2026:75580 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | sudo | 1.9.17-10.p2.el10_2.7 | RLSA-2026:75579 |
| Rocky Linux 9 | sudo | 1.9.17p2-3.el9_8.3 | RLSA-2026:75571 |
| Rocky Linux 8 | sudo | 1.9.5p2-2.el8_10 | RLSA-2026:75580 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | sudo | 1.9.17_p2-r2 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | sudo +3 | 1.9.15-1.p5.amzn2023.0.4 | ALAS2023-2026-3156 |
| Amazon Linux 2 | sudo +1 | 1.8.23-10.amzn2.3.9 | ALAS2-2026-3964 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | sudo | 1.9.17-4 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | sudo +1 | 1.9.17-10.p2.el10_2.7 | ELSA-2026-75579 |
| Oracle Linux 9 | sudo +1 | 1.9.17p2-3.el9_8.3 | ELSA-2026-75571 |
| Oracle Linux 8 | sudo | 1.9.5p2-2.0.1.el8_10 | ELSA-2026-75580 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
abraxas/CVE-2026-96512 ★ 0 · Sep 25, 2026
CVE-2026-96512 - sudo - High 7.8 - Authenticated LOCAL TZ=UTC+14 sudo -n /usr/bin/id - Local Privilege Escalation via Time-Window Bypass
-
Ermensonx/sudotimewarp-cve-2026-96512- ★ 0 · Sep 25, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 17
- ALSA-2026:75571 Important: sudo security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:75579 Important: sudo security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:75580 Important: sudo security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-3551 sudo: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Oct 28, 2026
- RHSA-2026:75580 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:75579 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:75571 Red Hat Security Advisory: sudo security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:71609 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- ALAS2-2026-3964 Important: sudo security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- ALAS2023-2026-3156 Important: sudo security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- USN-8895-1 sudo vulnerability Ubuntu Security Notices (USN) · Oct 8, 2026
- RLSA-2026:75579 Important: sudo security update Rocky Linux Security Advisories · Oct 6, 2026
- RLSA-2026:75571 Important: sudo security update Rocky Linux Security Advisories · Oct 6, 2026
- RLSA-2026:75580 Important: sudo security update Rocky Linux Security Advisories · Oct 6, 2026
- ELSA-2026-75579 Important: sudo security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 6, 2026
- ELSA-2026-75571 Important: sudo security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 5, 2026
- ELSA-2026-75580 Important: sudo security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 5, 2026
References
- RHSA-2026:71609 vendor-advisory
- RHSA-2026:75571 vendor-advisory
- RHSA-2026:75579 vendor-advisory
- RHSA-2026:75580 vendor-advisory
- RHSA-2026:82939 vendor-advisory
- RHSA-2026:86633 vendor-advisory
- RHSA-2026:86634 vendor-advisory
- RHSA-2026:86635 vendor-advisory
- RHSA-2026:87026 vendor-advisory
- RHSA-2026:90287 vendor-advisory
- RHSA-2026:91217 vendor-advisory
- RHSA-2026:91219 vendor-advisory
- RHSA-2026:91244 vendor-advisory
- RHSA-2026:92325 vendor-advisory
- RHSA-2026:92326 vendor-advisory
- RHSA-2026:92349 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-96512 vdb-entry
- RHBZ#2539327 issue-tracking
- https://github.com/sudo-project/sudo/commit/1820a349687522f51023d1ae5925125f59679a8c