CVE-2026-96512

A flaw in sudo causes time-based authorization checks (NOTBEFORE and NOTAFTER sudoers directives) to be evaluated using the caller's TZ environment variable whenever the rule's timestamp omits the trailing 'Z' UTC indicator. Because sudo runs setuid-root, any local unprivileged user who is permitted to run a command under such a rule can set TZ to an extreme timezone offset and shift the authorization window by up to roughly 25 hours, allowing expired rules to be treated as still valid (or not-yet-valid rules to fire early). The attacker gains the ability to execute allowed commands outside the intended time window, but authentication is not bypassed and only the time-based check is affected. Hosts are only exposed if their sudoers policy actually uses NOTBEFORE/NOTAFTER entries written without a trailing 'Z', which is an uncommon configuration, though the attacker also needs a valid local account with sudo-derived privileges. The flaw was assigned by Red Hat; no public proof of concept exists and it is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Audit all sudoers files (including #include'd fragments) for NOTBEFORE and NOTAFTER entries and append a trailing 'Z' (UTC) to every timestamp so evaluation no longer depends on the caller's TZ variable. Also check whether TZ appears in env_keep or is otherwise passed through, and remove it if policy does not require it. Apply vendor updates for sudo as patched packages become available, since no version fix is identified in the current advisory data.