CVE-2026-96512: Sudo Time-Based Privilege Escalation

CVE-2026-96512 Overview

CVE-2026-96512 is an authorization flaw in sudo affecting the evaluation of NOTBEFORE and NOTAFTER time-based access rules in sudoers. When timestamps in these rules omit the trailing Z timezone indicator, sudo evaluates them against the TZ environment variable inherited from the invoking user. Because sudo is a setuid-root program, a local unprivileged user can set TZ to an extreme offset and shift the authorization window by roughly 25 hours. Expired or not-yet-valid time-restricted rules are then treated as active, letting the user execute allowed commands outside the intended window. The weakness is classified as [CWE-863: Incorrect Authorization].

Critical Impact
Local users can execute time-restricted sudo commands outside their permitted window, undermining scheduled least-privilege access controls on affected Linux systems.

Affected Products

sudo builds that honor the user-supplied TZ environment variable during sudoers time-rule evaluation
Linux distributions packaging vulnerable versions of sudo (see Red Hat advisory for specific streams)
Systems relying on NOTBEFORE/NOTAFTERsudoers directives without the trailing Z UTC indicator

Discovery Timeline

2026-09-23 - CVE-2026-96512 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-96512

Vulnerability Analysis

The flaw resides in sudo's handling of the local time zone when parsing NOTBEFORE and NOTAFTER fields in sudoers. These directives allow administrators to restrict when a rule is valid. When the configured timestamp omits the trailing Z UTC marker, sudo interprets it in local time, and the local time is derived from the process environment. Because sudo runs setuid-root and previously did not strip TZ before calling tzset(3), the calling user's TZ value drove the comparison. Authentication itself remains intact; the defect is limited to the authorization window computation for time-scoped rules.

Root Cause

The root cause is trust in an attacker-controlled environment variable inside a setuid-root program. sudo's set_time_zone() function attempted to isolate tzset(3) by swapping the environ pointer to an empty array, but it did not remove TZ from the actual process environment used by libc when resolving the current time. A user setting TZ to an extreme offset such as TZ=UTC-24 or TZ=UTC+24 could move the evaluated "now" by approximately 25 hours, bringing an already-expired or not-yet-active rule into range.

Attack Vector

Exploitation requires local shell access as a user who has at least one sudoers rule constrained by NOTBEFORE or NOTAFTER timestamps that omit the Z suffix. The attacker exports a crafted TZ value and invokes sudo with a command permitted by the time-restricted rule. sudo evaluates the rule against the shifted local time, treats it as valid, and executes the command with the elevated privileges specified in the rule.

// Patch: src/sudo.c - remove TZ from sudo's environment before tzset(3)
/*
 * Set the time zone using tzset(3), removing the user's TZ
 * environment variable.  The original value of TZ may still
 * be present in the command's environment, depending on sudoers.
 */
static void
set_time_zone(void)
{
    /* Use system time zone, not user-specified. */
    unsetenv("TZ");
    (void) tzset();
}

Source: GitHub Sudo Project Commit 1820a349

Detection Methods for CVE-2026-96512

Indicators of Compromise

Successful sudo invocations logged in /var/log/secure or the journal outside the NOTBEFORE/NOTAFTER window defined in sudoers.
sudo audit entries where the invoking process environment (captured by auditd or eBPF telemetry) contains a TZ value with an unusual offset such as UTC-24 or UTC+24.
Presence of NOTBEFORE= or NOTAFTER= directives in /etc/sudoers or /etc/sudoers.d/* whose timestamps do not end in Z.

Detection Strategies

Correlate the effective execution timestamp of each sudo command with the NOTBEFORE/NOTAFTER window declared for the matched rule; flag mismatches.
Alert on any process invoking sudo with a TZ environment variable set to a non-standard or extreme offset.
Inventory sudoers files across the fleet and flag time-restricted rules whose timestamps lack the trailing Z.

Monitoring Recommendations

Ingest sudo and auditd logs into a centralized analytics pipeline and build a rule that pairs sudo execution events with their environment snapshot.
Monitor package inventories for the installed sudo version and confirm patched builds are deployed across all Linux hosts.
Review privileged access reports weekly to confirm time-scoped sudoers rules are not being invoked outside expected windows.

How to Mitigate CVE-2026-96512

Immediate Actions Required

Apply vendor updates that include the upstream fix in sudo commit 1820a349687522f51023d1ae5925125f59679a8c, which calls unsetenv("TZ") before tzset(3).
Audit all sudoers files and rewrite NOTBEFORE/NOTAFTER timestamps to include the trailing Z (UTC) indicator.
Restrict interactive shell access on hosts using time-based sudoers rules until patching is complete.

Patch Information

The upstream fix removes TZ from sudo's working environment before invoking tzset(3) so that time comparisons use the system time zone rather than a user-controlled value. See the Red Hat CVE-2026-96512 Advisory and the Red Hat Bug Report #2539327 for distribution-specific package versions. The upstream change is documented in the GitHub Sudo Project Commit.

Workarounds

Rewrite every NOTBEFORE and NOTAFTER timestamp in sudoers to end with Z, forcing UTC interpretation and bypassing the TZ lookup path.
Remove or tighten time-restricted sudoers rules where a scheduling requirement is not strictly necessary.
Use env_delete in sudoers defaults to strip TZ from the environment as a defense-in-depth measure on unpatched hosts.

bash

# /etc/sudoers.d/harden-tz - use UTC timestamps and strip TZ
Defaults env_delete += "TZ"

# Time-restricted rule using explicit UTC (trailing Z)
operator ALL = NOTBEFORE=20260101000000Z NOTAFTER=20261231235959Z /usr/bin/systemctl restart myservice