sudo: failed setuid/setgid/setgroups before running the mailer is non-fatal, allowing privilege escalation

Impact

When sudo drops privileges before spawning its mailer, a failure of setuid(), setgid() or setgroups() is not treated as fatal, so the mailer can run with privileges it should have shed. A local user who can make those calls fail - the classic route is exhausting a process limit - gets the mailer executing at higher privilege, which the record rates as full local privilege escalation (confidentiality, integrity and availability all high). sudo is on every GPU node an operator manages, and the login nodes and interactive shells that HPC users share are exactly where untrusted local users already have a shell. Exposure depends on sudo being configured to send mail at all; a sudoers file with mailing disabled does not reach the affected path.

Who can reach it

A local user on the host with a shell and any sudoers entry that triggers the mailer. Authentication to the machine is required; no sudo rights on the target command are needed beyond whatever causes sudo to mail.

What to do

Update the sudo package to a build containing upstream commit 3e474c2 - versions through 1.9.17p2 are affected. Distribution updates are available via the Debian LTS announcement and Ubuntu tracker referenced in the record; Red Hat lists RHUI 5 and RHEL 6/7 ELS among affected products. A package update is enough - sudo is invoked fresh each time, so no reboot and no drain is needed, and running jobs are untouched. As an interim measure, disable sudo's mail options in sudoers so the vulnerable code path is not reached.

References

Related entries

• QEMU: guest-triggered out-of-bounds write when a physical memory map returns shortCVE-2026-3842 · QEMU (cpu_physical_memory_map short-mapping handling)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-43206 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel (drivers/pci): The PCI slot-lock failure path releases a lock the caller never took, which at best warnsCVE-2026-43211 · Linux kernel (drivers/pci)High
• Linux kernel (net/rds): When pinning user pages for a zerocopy RDS send fails, the pages are released but theCVE-2026-43494 · Linux kernel (net/rds)High
• Linux kernel (net/rds): A zerocopy RDS send that fails after pinning user pages but before the message reaches theCVE-2026-43502 · Linux kernel (net/rds)High
• Linux kernel (drivers/iommu/intel): VT-d publishes the address of a freshly allocated PASID table into the PASIDCVE-2026-45862 · Linux kernel (drivers/iommu/intel)High