sudo-rs: sudoedit vulnerability patched for Ubuntu 26.10

Canonical released security advisory USN-8708-2 on 20 October 2026, extending the fix for a vulnerability in sudo-rs to Ubuntu 26.10 following the patch issued for Ubuntu 26.04 LTS last month. For administrators running the new release, this is a standard update that can be applied with a regular apt upgrade without any additional intervention.\n\n## The Issue\n\nThe official advisory explains that sudo-rs was found to handle time-of-check versus time-of-use conditions incorrectly in sudoedit. In essence, a local attacker with permission to modify specific files via sudoedit could exploit the vulnerability to place files in arbitrary directories and potentially achieve privilege escalation.\n\nUsers running the default configuration are not exposed: the issue only affects systems configured to grant granular file modification permissions via sudoedit, which is not the default setup.\n\nThe upstream advisory from the sudo-rs project, published on GitHub, provides more detail on the actual risk: a user permitted to place files in an arbitrary directory can (by placing a file in /etc/sudoers.d) clearly achieve full privilege escalation. Affected versions range from 0.2.8 onwards, whilst versions 0.2.7 and earlier are unaffected; the bug is fixed in sudo-rs 0.2.15.\n\n## Patch Timeline\n\nThe issue had already been corrected in September: USN-8708-1 fixed the vulnerability in sudo-rs; this update provides the corresponding fix for Ubuntu 26.10. The first affected release was Ubuntu 26.04 LTS, with the advisory published on 1 September 2026.\n\n## Fixed Versions\n\n| Ubuntu Release | Package | Fixed Version |\n|---|---|---|\n| 26.04 LTS | sudo-rs | 0.2.13-0ubuntu1.2 |\n| 26.10 | sudo-rs | 0.2.14-1ubuntu4.1 |\n\n## How to Update\n\nA standard system update typically applies all necessary changes. The bug is tracked on Launchpad under reference number 2165142. Administrators managing Ubuntu server fleets with extended coverage can verify patch status through Ubuntu Pro, which covers packages in Main and Universe."