UBUNTU-CVE-2026-35535

Details

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.

Affected Packages

sudo

Ubuntu 22.04 LTS

Fixed in:

1.9.9-1ubuntu2.6

sudo

Ubuntu 24.04 LTS

Fixed in:

1.9.15p5-3ubuntu5.24.04.2

sudo

Ubuntu 25.10

Fixed in:

1.9.17p2-1ubuntu1.1

References

REPORT

https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69

REPORT

https://ubuntu.com/blog/apparmor-vulnerability-fixes-available

REPORT

https://ubuntu.com/security/CVE-2026-35535

ADVISORY

https://ubuntu.com/security/notices/USN-8092-1

REPORT

https://ubuntu.com/security/vulnerabilities/crackarmor

REPORT

https://www.cve.org/CVERecord?id=CVE-2026-35535

REPORT

https://www.qualys.com/2026/03/10/crack-armor.txt