[High] Patch sudo for CVE-2026-82474.

[AkarshHCL]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Patch Sudo for CVE-2026-82474 , Cve details-Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.

Change Log

• SPECS/sudo/CVE-2026-82474.patch
• SPECS/sudo/sudo.spec

Vulnerability Test

1. we are in the affected range for this cve.
2. tried build by adding error in the affected files the build fails.

*Patch backport details

1. Their are two files in upstream patch getting changed .
2. In Azl patch the file-exec_ptrace.h is same as upstream patch changes .
3. The file exec_ptrace.c is being backported to make it in sync with our source the details about the backport are as follows-

Upstream targets sudo master (post-1.9.17p2), which had already drifted from 1.9.17 in two ways: proc_read_link() returns ssize_t on master but bool on 1.9.17, and master's get_exec_info() carries a /proc/self/fd/N resolution block that 1.9.17 lacks. As a result, 39/44 hunks applied verbatim and 5 (the proc_read_link / get_exec_info region in exec_ptrace.c) were rejected on context and adapted by hand. Of those 5, most are upstream-verbatim code that only needed re-placement; the only genuine additions beyond upstream's diff are:

The proc_read_link bool→ssize_t refactor: static ssize_t, debug_return_ssize_t(-1), if (len != -1 && (size_t)len != bufsize), and the "name and buf may overlap" note.
The two consequent caller updates: /proc/PID/exe and /proc/PID/cwd → == -1.
Reconstructing the /proc/self/fd/N block as additions (1.9.17 had no such block to modify).
The resulting source is byte-identical to upstream's fix.

Does this affect the toolchain?

NO

Links to CVEs

• https://nvd.nist.gov/vuln/detail/cve-2026-82474

Test Methodology

• Local Build

• Patch application during build

• Buddy Build -https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1194826&view=results

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[AkarshHCL]

Buddy Build- https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1195427&view=results

[AkarshHCL]

Buddy Build-https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1195445&view=results

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.