Sudo Execveat Policy Bypass in Ptrace Intercept Mode

CVE-2026-82474 is a privilege escalation vulnerability in sudo versions through 1.9.17p2 that undermines the security model of command-based access controls. When sudo operates in ptrace-based intercept mode, it fails to validate policy restrictions on the execveat system call, allowing users with permission to run specific commands to execute arbitrary denied programs by invoking execveat directly or through fexecve wrapper functions. This completely bypasses sudo's logging and policy enforcement mechanisms. Organizations relying on sudo for fine-grained privilege delegation—particularly those restricting command execution on multi-user systems or shared infrastructure—face significant risk, as unprivileged users granted limited sudo privileges can silently escalate to run any program without audit trails.

While CVE-2026-82474 lacks formal MITRE ATT&CK mappings, Casky's 754 security skills enable detection of the underlying attack patterns through Claude's extended reasoning capability. A practitioner would identify this vulnerability by correlating multiple behavioral signals: unexpected execveat or fexecve syscall activity from sudo processes that deviate from policy baselines, absence of corresponding sudo log entries for executed commands, privilege escalation attempts followed by denied-command execution, and ptrace-mode interception gaps where policy checks should have triggered. Casky's skill-based analysis would flag the discrepancy between sudo's authorization policy and actual process execution, revealing the intercept bypass pattern—critical for organizations implementing sudo-based privilege management who need to detect whether this weakness is being exploited in their environment.