# CVE-2026-72693: Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Status: published. Published: 2026-08-11. Updated: 2026-11-02.

`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.

## Remediation

- workaround: To mitigate this issue, avoid using `openvt -u` in privileged `kbrequest`/init deployments. Instead, configure the keyboard request to initiate a standard authenticated login on the new virtual terminal, or disable the keyboard request binding entirely until a fix is available. Changes to `kbrequest` configurations may require a system restart or service reload to take effect. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 10 (kbd): ≥ 0:2.6.4-8.el10_2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (kbd): ≥ 0:2.0.4-11.el8_10.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (kbd): ≥ 0:2.4.0-12.el9_8; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.22 (openshift/ose-rhel-coreos-9): ≥ 4.22.9.8.202608251819-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.22 (openshift/ose-rhel-coreos-9): ≥ 4.22.9.8.202609081748-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (kbd-main): ≥ 2.10.0-2.hum1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (kbd): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (kbd): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-8): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 5 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: redhat

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: 0.11% as of 2026-11-01; percentile 1.25%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-284

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:41136 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:57597 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:57610 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:60440 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:66357 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:78951 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-72693 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2462115 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:41136 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:57597 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:57610 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:60440 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:66357 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:78951 (secalert@redhat.com)

- https://access.redhat.com/security/cve/CVE-2026-72693 (secalert@redhat.com)

- https://bugzilla.redhat.com/show_bug.cgi?id=2462115 (secalert@redhat.com)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-72693; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72693; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-72693; retrieved 2026-11-02; source updated Not reported

Revision: 851cbac68bf395e601c10b8fb5d0fb9e55d66d43428ddbd531edc14d9cad952e

Canonical: https://y2.dev/cve/CVE-2026-72693