From a905e4a4c152a1e6d86e8c1d95c4fdca326993e7 Mon Sep 17 00:00:00 2001
From: Ryan Hendrickson <ryan.hendrickson@alum.mit.edu>
Date: Thu, 24 Sep 2026 05:20:17 -0400
Subject: [PATCH] sudo: fix CVE-2026-96512

(cherry picked from commit ce287a157dc15a3aae83c0012540efb5c45910c0)
---
 pkgs/by-name/su/sudo/package.nix | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/su/sudo/package.nix b/pkgs/by-name/su/sudo/package.nix
index 781761698db3..b7cf22098efb 100644
--- a/pkgs/by-name/su/sudo/package.nix
+++ b/pkgs/by-name/su/sudo/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  fetchpatch2,
   fetchurl,
   buildPackages,
   coreutils,
@@ -31,9 +32,22 @@ stdenv.mkDerivation (finalAttrs: {
 
   prePatch = ''
     # do not set sticky bit in nix store
-    substituteInPlace src/Makefile.in --replace 04755 0755
+    substituteInPlace src/Makefile.in --replace-fail 04755 0755
   '';
 
+  patches = [
+    (fetchpatch2 {
+      name = "CVE-2026-96512_1.patch";
+      url = "https://github.com/sudo-project/sudo/commit/db669167ca599f2a94cd8a4c5fae9e473c81a2fd.patch?full_index=1";
+      hash = "sha256-VqfWo/z7CQCtgefzE8xAehjgKn2h1It6GkEt5BUn/OQ=";
+    })
+    (fetchpatch2 {
+      name = "CVE-2026-96512_2.patch";
+      url = "https://github.com/sudo-project/sudo/commit/1820a349687522f51023d1ae5925125f59679a8c.patch?full_index=1";
+      hash = "sha256-guOdOaIqmXAftpj9gpsRFaAS5g2cS4j7o5DQFqyLZv8=";
+    })
+  ];
+
   configureFlags = [
     "--with-env-editor"
     "--with-editor=/run/current-system/sw/bin/nano"