High [CVE-2026-82474] Policy bypass allows unauthorized program execution via execveat
This high-severity Red Hat Linux advisory covers CVE-2026-82474 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in Sudo. This vulnerability allows users who are permitted to run specific commands to bypass security policy checks when using the `execveat` system call in ptrace-based intercept mode.
By directly calling `execveat` or `fexecve`, an attacker can execute programs that would otherwise be denied, thereby circumventing policy enforcement and logging mechanisms. This vulnerability in Sudo allows a local attacker, already authorized to run specific commands, to bypass configured policy restrictions.
By directly invoking `execveat` or `fexecve` when Sudo is operating in ptrace-based intercept mode, an attacker can execute programs otherwise denied by `sudo` policies. This undermines granular access control and could lead to unauthorized command execution on affected Red Hat systems.
Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-1220.
Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images. Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Red Hat package: sudo.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- To mitigate this issue, disable the ptrace-based intercept mode in the `sudoers` configuration. Add `Defaults !intercept` to `/etc/sudoers` or a file within `/etc/sudoers.d/`. This action may affect advanced `sudo` policy enforcement or logging features that rely on ptrace-based interception. Always validate `sudoers` file changes with `visudo` to prevent system lockout.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.