Skip to content
Fencer Vulns
high 7.8

CVE-2026-72693 json

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

published 2026-08-11 2 mo ago modified 2026-11-05 3 d ago also EUVD-2026-55978

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 3%
public exploits
0
none known

Summary

`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:2.6.4-8.el10_2
  • Red Hat Red Hat Enterprise Linux 8 0:2.0.4-11.el8_10.1
  • Red Hat Red Hat Enterprise Linux 9 0:2.4.0-12.el9_8
  • Red Hat Red Hat OpenShift Container Platform 4.22 4.22.9.8.202608251819-0, 4.22.9.8.202609081748-0
  • Red Hat Red Hat Hardened Images 2.10.0-2.hum1
  • kbd Debian 14 2.10.0-1

debian advisories DEBIAN-CVE-2026-72693

  • kbd RHEL 8 2.0.4-11.el8_10.1
  • kbd-misc RHEL 8 2.0.4-11.el8_10.1
  • kbd-legacy RHEL 8 2.0.4-11.el8_10.1
  • kbd RHEL 9 2.4.0-12.el9_8
  • kbd-misc RHEL 9 2.4.0-12.el9_8
  • kbd-legacy RHEL 9 2.4.0-12.el9_8
  • kbd RHEL 10.2 2.6.4-8.el10_2
  • kbd-misc RHEL 10.2 2.6.4-8.el10_2

red hat advisories RHSA-2026:78951RHSA-2026:57610RHSA-2026:57597RHSA-2026:41136

  • kbd SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.7.1-160000.3.1
  • kbd SLE Module for Basesystem 15 SP7 2.4.0-150700.15.10.1
  • kbd Linux Micro 6.1 2.6.4-slfo.1.1_2.1
  • kbd Linux Micro 6.0 2.6.4-2.1
  • kbd SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +10 more 2.4.0-150400.5.12.1

suse advisories SUSE-SU-2026:23893-1SUSE-SU-2026:23911-1SUSE-SU-2026:4211-1SUSE-SU-2026:23742-1SUSE-SU-2026:23844-1SUSE-SU-2026:4207-1

  • kbd openSUSE Leap 16.0 2.7.1-160000.3.1

opensuse advisories openSUSE-SU-2026:21939-1

  • kbd AlmaLinux 8 2.0.4-11.el8_10.1
  • kbd-misc AlmaLinux 8 2.0.4-11.el8_10.1
  • kbd-legacy AlmaLinux 8 2.0.4-11.el8_10.1
  • kbd AlmaLinux 10 2.6.4-8.el10_2
  • kbd-misc AlmaLinux 10 2.6.4-8.el10_2
  • kbd-legacy AlmaLinux 10 2.6.4-8.el10_2
  • kbd AlmaLinux 9 2.4.0-12.el9_8
  • kbd-misc AlmaLinux 9 2.4.0-12.el9_8

almalinux advisories ALSA-2026:78951ALSA-2026:57597ALSA-2026:57610

  • kbd Rocky Linux 8 2.0.4-11.el8_10.1
  • kbd Rocky Linux 10 2.6.4-8.el10_2
  • kbd Rocky Linux 9 2.4.0-12.el9_8

rocky linux advisories RLSA-2026:78951RLSA-2026:57597RLSA-2026:57610

  • kbd Azure Linux 3.0 2.2.0-3

azure linux advisories AZL-95928

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-72693 updated cvss 7.8

kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

  • Red Hat Enterprise Linux 6 kbd, kbd-misc
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 kbd, kbd-misc, kbd-legacy Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available
  • Red Hat Enterprise Linux BaseOS (v. 8) kbd 2.0.4-11.el8_10.1, kbd-misc 2.0.4-11.el8_10.1, kbd-legacy 2.0.4-11.el8_10.1
    fixed: vendor fix RHSA-2026:78951
  • Red Hat Enterprise Linux BaseOS (v. 9) kbd 2.4.0-12.el9_8, kbd-misc 2.4.0-12.el9_8, kbd-legacy 2.4.0-12.el9_8
    fixed: vendor fix RHSA-2026:57610
  • Red Hat Enterprise Linux BaseOS (v. 10) kbd 2.6.4-8.el10_2, kbd-misc 2.6.4-8.el10_2, kbd-legacy 2.6.4-8.el10_2
    fixed: vendor fix RHSA-2026:57597
  • Red Hat Hardened Images kbd 2.10.0-2.hum1, kbd-misc 2.10.0-2.hum1, kbd-legacy 2.10.0-2.hum1
    fixed: vendor fix RHSA-2026:41136
  • Red Hat OpenShift Container Platform 4.22 rhcos 4.22.9.8.202608251819, rhcos 4.22.9.8.202609081748
    fixed: vendor fix RHSA-2026:60440

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.