sudo: intercept policy checks skipped for execveat, letting allowed users run denied commands

Impact

On fleets that use sudo's intercept mode (ptrace-based sub-command interception) to constrain what an operator or on-call engineer may run, a user permitted to run one command can execute programs the policy denies by invoking execveat directly or via fexecve. The bypassed action is also not logged, so the sudo audit trail no longer reflects what actually ran on the node. On a shared GPU host this matters most where intercept mode is the control that keeps a limited operator away from full root-equivalent tooling - driver reload, nvidia-smi persistence changes, container runtime configuration. Systems that only use ordinary sudoers rules without intercept/log_subcmds are not affected by this bypass.

Who can reach it

Local, authenticated user who already holds a sudoers entry permitting at least one command under intercept mode. No remote reach and no additional privilege needed beyond that existing sudo grant.

What to do

Affected through sudo 1.9.17p2; the record links an upstream commit (71fbe42dcd5a1c8f799540583a2dfb2ae6221edf) but no fixed release number is stated, so track your distribution's sudo package advisory rather than assuming a version. Upgrading the sudo package takes effect for new invocations - no daemon restart and no reboot. Until a package is available, treat intercept mode as advisory rather than a security boundary and constrain the underlying sudoers rules instead.

References

Related entries

• Linux kernel (arch/x86/kvm/svm): Hardware ignores the low five bits of CR3 when loading PDPTEs, but KVM's nested SVMCVE-2024-50115 · Linux kernel (arch/x86/kvm/svm)High
• Linux kernel (arch/x86/kvm): A nested guest can put an out-of-range virtual-processor ID into an enlightened VMCS andCVE-2026-64247 · Linux kernel (arch/x86/kvm)High
• Linux kernel io_uring: per-task restrictions are freed across exec, so post-exec rings are unrestrictedCVE-2026-80713 · Linux kernel io_uring (per-task restrictions dropped on exec)High
• Intel Data Center GPU driver for VMware ESXi (out-of-bounds read): Out-of-bounds read in the ESXi GPU driver exposingCVE-2026-20751 · Intel Data Center GPU driver for VMware ESXi (out-of-bounds read)High
• Intel Data Center GPU driver for VMware ESXi (out-of-bounds write): Out-of-bounds write in the ESXi GPU driver causingCVE-2026-20879 · Intel Data Center GPU driver for VMware ESXi (out-of-bounds write)High
• Xen PCI passthrough on Intel VT-d chipsets without interrupt remapping: The founding GPU-passthrough escape. A guestCVE-2011-1898 · Xen PCI passthrough on Intel VT-d chipsets without interrupt remappingHigh