Fedora Account System
Red Hat Associate
Red Hat Customer
A flaw was found in sudo's handling of NOTBEFORE and NOTAFTER time-based authorization in sudoers rules. The parse_gentime() function in plugins/sudoers/gentime.c uses mktime() to interpret timestamps that lack a timezone suffix (no trailing 'Z' or explicit UTC offset). Because mktime() converts based on the process's TZ environment variable, and sudo is a setuid-root program that inherits the caller's environment, an unprivileged user can set TZ to an extreme POSIX timezone offset (e.g., TZ=XXX24) to shift the time evaluation window by up to ~25 hours in either direction. This allows expired NOTAFTER rules to appear valid, or not-yet-active NOTBEFORE rules to become usable. Authentication (PAM) is NOT bypassed; only the time-based authorization decision is affected. The feature was introduced in sudo 1.8.20. All versions from 1.8.20 through 1.9.17p2 are affected. The fix was committed to upstream main by Todd Miller on 2026-08-29 (commit 1820a349687522f51023d1ae5925125f59679a8c) but sudo 1.9.18 has not been released. Reported by Ermenson Junior (independent security researcher) on 2026-08-28. PSIRT Ticket: PSIRTSUPT-24357
Additional information: A public PoC / exploit for CVE-2026-96512 is available here: https://github.com/abraxas/cve-2026-96512 Red Hat CVE page: https://access.redhat.com/security/cve/cve-2026-96512 Since publicly available exploit code may increase the practical exploitation risk, could you please take this into account when prioritizing the affected-product analysis and remediation for RHEL? Thank you.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:75580 https://access.redhat.com/errata/RHSA-2026:75580
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:75579 https://access.redhat.com/errata/RHSA-2026:75579
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:75571 https://access.redhat.com/errata/RHSA-2026:75571
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:86633 https://access.redhat.com/errata/RHSA-2026:86633
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:86635 https://access.redhat.com/errata/RHSA-2026:86635
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:86634 https://access.redhat.com/errata/RHSA-2026:86634
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:87026 https://access.redhat.com/errata/RHSA-2026:87026
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:90287 https://access.redhat.com/errata/RHSA-2026:90287
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:92325 https://access.redhat.com/errata/RHSA-2026:92325
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:92326 https://access.redhat.com/errata/RHSA-2026:92326
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:92349 https://access.redhat.com/errata/RHSA-2026:92349