A newly disclosed high-severity flaw in Sudo, tracked as CVE-2026-96512, lets a local Linux user trick the utility into misreading the time windows that decide when elevated access is allowed. The bug matters now because a fix exists in Sudo’s source code but, as of the advisory’s publication, had not shipped in any official Sudo release.
The core problem is small but consequential. Attackers who already hold a time-restricted sudo rule can set a crafted TZ environment variable and shift Sudo’s view of the clock by roughly 25 hours in either direction. That is enough to make an expired permission look valid again, or to unlock a permission before its scheduled start.
Red Hat is tracking the issue as Bug 2539327, rated high severity and high priority. Versions 1.8.20 through 1.9.17p2 are affected, and administrators are being told to watch for vendor packages while auditing any sudoers rules that depend on time limits.
Who is actually exposed
This is not a path to root for every account on a machine. The advisory is clear that exploitation requires an existing sudo rule restricted by the NOTBEFORE or NOTAFTER tags, and the user must still meet every other condition that rule sets.
Authentication is also untouched. If a rule demands a password, multifactor login, or another PAM-controlled step, the user still has to pass it. Only the time-based authorization check can be manipulated.
Where the risk concentrates
The organizations with the most to lose are those using expiring sudo rules as a safety control, such as:
| Use of time-bound sudo rules | What the flaw could enable |
|---|---|
| Temporary admin access for contractors | Access continuing past its end date |
| Scheduled maintenance windows | Privileged commands run outside the window |
| Emergency or break-glass access | Expired emergency rights reused later |
| Pre-scheduled privilege grants | Rights used up to about a day early |
In practice, someone whose maintenance entitlement lapsed yesterday could adjust their TZ value and have Sudo treat the rule as still live.
How the timezone trick works
The weakness sits in Sudo’s parse_gentime() function, which reads the timestamps used in NOTBEFORE and NOTAFTER entries. When a timestamp lacks an explicit timezone marker, such as a trailing “Z” for UTC or a numeric offset, the code passes it to the standard mktime() function.
mktime() interprets time according to whatever TZ value is in the process environment. Because Sudo runs setuid-root yet inherits part of the calling user’s environment, the user effectively chooses the timezone Sudo uses to evaluate its own policy.
The 25-hour swing
According to the advisory, an extreme POSIX timezone string such as TZ=XXX24 pushes the effective policy time by up to about 25 hours. Pointed one way, a NOTAFTER deadline that has passed appears to lie in the future. Pointed the other way, a NOTBEFORE start time appears to have already arrived.
Rules written with an explicit UTC “Z” suffix or numeric offset fall outside the vulnerable code path described in the advisory, which makes timestamp format worth checking during any audit.
TZ has caused trouble before
This is not the first time the TZ variable has created a Sudo security problem. Before sudo 1.8.12, the variable was passed through without checks, and because most C library implementations accept an absolute path as a time zone, it could point to an arbitrary user-controlled file. That earlier issue was assigned CVE-2014-9680, and starting with 1.8.12, Sudo only passes TZ through by default when it is judged safe. The new flaw differs in that it abuses a well-formed timezone value to distort Sudo’s own policy math rather than to reach files.
Patch status
| Item | Detail |
|---|---|
| CVE | CVE-2026-96512 |
| Affected versions | Sudo 1.8.20 through 1.9.17p2 |
| Red Hat tracking | Bug 2539327, high severity, high priority |
| Upstream fix | Commit 1820a349687522f51023d1ae5925125f59679a8c |
| Fix author and date | Todd Miller, August 29, 2026 |
| Released version with fix | Not yet available at time of disclosure |
The upstream change strips TZ from Sudo’s working environment before the timezone is set, so user-supplied values can no longer steer mktime() or related time handling.
What administrators should do now
Until distributions publish updated packages, the practical step is inventory. Search sudoers files, and any directory-backed sudo policies, for NOTBEFORE and NOTAFTER entries, and rank them by how sensitive the granted commands are. Rules meant to expire on their own deserve the closest look, since those are exactly the ones attackers would try to revive.
Once vendor updates land, apply them promptly. Longer term, the advisory recommends against treating time-bound sudoers rules as the only guard on high-risk privileges. Pairing them with centrally enforced identity controls, short-lived credentials, logging, and regular sudoers reviews limits the damage when a local policy check turns out to be weaker than expected.
