CVE-2026-72693: openvt Privilege Escalation Vulnerability

CVE-2026-72693 Overview

CVE-2026-72693 is a local privilege escalation vulnerability in the openvt utility's -u code path. The -u flag identifies the owner of the current virtual terminal (VT) and then executes login as that user from a privileged context. The ownership check in authenticate_user() relies on stat("/proc/<pid>/fd/0"), which follows the symlink to the underlying TTY device node instead of inspecting the process owner. When invoked from the documented kbrequest/init deployment using openvt -us, this flaw allows an unprivileged process to trigger a passwordless login -f root on the spawned VT.

Critical Impact
Local attackers with a file descriptor attached to a reused TTY can obtain a passwordless root login shell on a newly spawned virtual terminal.

Affected Products

kbd package supplying the openvt utility
Red Hat Enterprise Linux distributions shipping vulnerable openvt (see RHSA-2026:41136)
Systems using the documented kbrequest/init deployment with openvt -us

Discovery Timeline

2026-08-11 - CVE-2026-72693 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database and Red Hat releases RHSA-2026:41136

Technical Details for CVE-2026-72693

Vulnerability Analysis

The flaw is an improper access control issue [CWE-284] in the authenticate_user() function of openvt. When openvt -u runs, it must determine which user owns the currently active VT before performing a passwordless login for that user. The implementation calls stat() against the path /proc/<pid>/fd/0 and reads the returned buf.st_uid field to identify the owner.

Because stat() dereferences symbolic links, the syscall resolves /proc/<pid>/fd/0 to the underlying TTY device node in /dev. The returned st_uid therefore reflects the current owner of the TTY device, not the UID of the process that holds the file descriptor. This mismatch breaks the security assumption the check is meant to enforce.

After a user logs out from a VT, the kernel and getty reset the TTY device ownership back to root or the getty user. An unprivileged process that inherited or retained fd 0 on that TTY can then trigger the openvt -u path. The ownership check succeeds against root, and openvt executes login -f root on the newly spawned VT without prompting for credentials.

Root Cause

The root cause is the use of stat() rather than fstat() on the process's actual file descriptor, combined with reliance on TTY device ownership as a proxy for process identity. Symlink resolution against /proc/<pid>/fd/0 returns metadata for the target device, not the descriptor's owning process.

Attack Vector

Exploitation requires local access with an unprivileged process that retains fd 0 on a TTY whose ownership has reverted to root or getty after logout. The attacker invokes openvt -us from the documented kbrequest/init privileged path. The faulty check then authorizes a passwordless login -f root on the spawned virtual terminal, yielding an interactive root session.

No verified exploit code is published. See the Red Hat CVE-2026-72693 Details page and Red Hat Bug Report #2462115 for the upstream analysis.

Detection Methods for CVE-2026-72693

Indicators of Compromise

Unexpected login -f root invocations spawned by openvt on virtual terminals outside of console-session startup.
Root shells parented by openvt or kbrequest handlers on systems where interactive console logins are not expected.
Non-root processes retaining fd 0 open against /dev/tty[N] after the associated user has logged out.

Detection Strategies

Audit process ancestry for openvt -> login -f root -> shell chains using execve telemetry from auditd or eBPF sensors.
Alert on any invocation of openvt with the -u or -us flags on production servers that do not rely on kbrequest/init console handoff.
Correlate TTY ownership transitions (chown on /dev/tty*) with subsequent privileged login events on the same VT.

Monitoring Recommendations

Enable auditd rules covering execve of /usr/bin/openvt and /bin/login with argument capture.
Monitor for setuid(0) transitions originating from processes whose parent is not systemd, init, or a documented session manager.
Forward VT and console session events to a centralized log store for retrospective hunting on kbd-package hosts.

How to Mitigate CVE-2026-72693

Immediate Actions Required

Apply the kbd package update distributed via Red Hat Security Errata RHSA-2026:41136 or the equivalent from your Linux distribution.
Inventory systems that invoke openvt -u or openvt -us from kbrequest, inittab, or systemd unit files and prioritize them for patching.
Restrict interactive console access on multi-user servers where local users could stage a descriptor-retention primitive.

Patch Information

Red Hat has published RHSA-2026:41136 with a fixed kbd package. Upstream corrections replace the symlink-following stat() against /proc/<pid>/fd/0 with a check that resolves the descriptor's owning process rather than the TTY device node. Track vendor advisories for downstream distribution packages.

Workarounds

Remove or disable openvt -u invocations from kbrequest handlers and init configurations until the patched kbd package is deployed.
Restrict execute permissions on /usr/bin/openvt to trusted administrative accounts on shared systems.
Remove the setuid bit from openvt on hosts that do not require VT switching by unprivileged users.

bash

# Configuration example: remove privileged openvt -u handlers and reduce exposure
sudo sed -i '/openvt .*-u/s/^/# DISABLED CVE-2026-72693 /' /etc/inittab
sudo chmod u-s /usr/bin/openvt
sudo chmod 750 /usr/bin/openvt