# Ubuntu 26.10 backports sudo-rs privilege escalation fix

> **Key takeaway:** Ubuntu 26.10 receives the sudo-rs fix for a time-of-check vs time-of-use vulnerability in sudoedit that could allow local privilege escalation on systems with fine-grained sudoedit permissions.

**Published:** 2026-10-20T14:23:39+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-2610-backports-sudo-rs-privilege-escalation-fix.html 

## Summary
Ubuntu has backported USN-8708-1 to Ubuntu 26.10 as USN-8708-2. The original advisory addressed a vulnerability in sudo-rs, the Rust rewrite of sudo, where sudoedit's handling of time-of-check vs time-of-use conditions could let a local attacker with sudoedit permissions write files to arbitrary directories and potentially escalate privileges. The vulnerable configuration—fine-grained sudoedit file editing permissions—is not enabled by default.

## Scope and affected configuration
- **Vulnerability type**: Time-of-check vs time-of-use (TOCTOU) race condition in sudoedit
- **Affected software**: sudo-rs, the Rust implementation of sudo
- **Attack vector**: Local attacker with existing sudoedit permissions for specific files
- **Impact**: Arbitrary file placement in directories, possible privilege escalation
- **Configuration requirement**: Only affects systems with fine-grained sudoedit permissions explicitly configured; default installations are not vulnerable

## Why it matters
The fix matters for Ubuntu 26.10 early adopters and administrators who have deployed non-default sudoedit configurations. sudo-rs remains a significant project as a memory-safe reimplementation of a critical setuid utility.