CVE-2026-74676 Overview
CVE-2026-74676 is a missing authorization vulnerability in the Linux kernel's virtual terminal (vt) subsystem. The KDSKBMETA ioctl modifies the keyboard meta mode but omits the !perm permission check enforced by every other keyboard setter ioctl in vt_k_ioctl(). A local unprivileged process can therefore change the keyboard meta mode on a virtual console it does not control. The Linux kernel maintainers have resolved the issue with a patch that adds the missing permission gate, matching the access control model used by sibling ioctls in the same handler.
Critical Impact
A local process can alter keyboard meta mode on a non-controlling virtual console without authorization, breaking the console access control model in vt_k_ioctl().
Affected Products
- Linux kernel virtual terminal (vt) subsystem
- Distributions shipping kernels prior to the fix commits referenced by the stable tree
- Systems exposing /dev/tty* virtual consoles to local users
Discovery Timeline
- 2026-08-22 - CVE-2026-74676 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74676
Vulnerability Analysis
The Linux kernel virtual terminal driver dispatches keyboard-related ioctls through vt_k_ioctl() in drivers/tty/vt/vt_ioctl.c. Setter ioctls that mutate keyboard state, such as KDSKBMODE, KDSKBENT, and KDSKBSENT, guard their operation with a !perm check that returns -EPERM when the calling process is not the owner of the target console. The KDSKBMETA ioctl, which sets the keyboard meta-key handling mode via vc->vc_kbd_table->kbdmode semantics, was missing this check. As a result, a process holding a file descriptor to any virtual console could invoke ioctl(fd, KDSKBMETA, value) and change the meta mode on a console it does not control. This is a local authorization bypass affecting console input handling behavior.
Root Cause
The root cause is an inconsistent authorization policy inside vt_k_ioctl(). The KDSKBMETA case did not call the shared !perm gate used by every other keyboard mutator in the same function. See the upstream fix commits 1c5b67a, 4671c3b, 7bf3233, 9f8cbaf, a1c31e0, a7ad003, d8ead50, and ddc4a83.
Attack Vector
Exploitation is local. An attacker with a process able to open a virtual console device node issues the KDSKBMETA ioctl targeting a console owned by another session. The kernel accepts the request and updates the meta mode without confirming caller ownership. No memory corruption is involved; the impact is limited to unauthorized modification of keyboard input state on the affected console.
No verified proof-of-concept code is available. Refer to the patch links above for the exact kernel change.
Detection Methods for CVE-2026-74676
Indicators of Compromise
- Unexpected changes in keyboard meta mode on tty devices not owned by the invoking user
- Unprivileged processes opening /dev/tty[0-9]* and issuing KDSKBMETA ioctls
- Audit records showing ioctl syscalls with request code 0x4B62 from non-console-owning UIDs
Detection Strategies
- Enable Linux audit rules on the ioctl syscall for tty devices and alert on KDSKBMETA (0x4B62) invocations from processes that do not own the target console.
- Correlate console session ownership (from utmp/loginuid) with processes performing keyboard setter ioctls.
- Track kernel version and patch status across the fleet to identify hosts still exposing the unpatched vt_k_ioctl() path.
Monitoring Recommendations
- Ingest auditd and syscall telemetry into a centralized analytics pipeline and flag KDSKBMETA calls originating from non-interactive service accounts.
- Monitor for privilege boundary violations on shared multi-user Linux hosts, jump boxes, and kiosk systems where virtual consoles are exposed.
- Alert on process trees that open multiple /dev/tty* nodes in short succession.
How to Mitigate CVE-2026-74676
Immediate Actions Required
- Apply the stable kernel update that adds the !perm check to the KDSKBMETA branch of vt_k_ioctl().
- Inventory hosts running kernels predating the fix commits and prioritize multi-user systems for patching.
- Restrict interactive shell access on systems where virtual consoles are reachable by untrusted local users.
Patch Information
The fix adds the missing permission check to KDSKBMETA so it behaves like the other keyboard setter ioctls in vt_k_ioctl(). The change is available across multiple stable branches. Reference commits: 1c5b67a, 4671c3b, 7bf3233, 9f8cbaf, a1c31e0, a7ad003, d8ead50, ddc4a83. Apply the update supplied by your Linux distribution.
Workarounds
- Limit access to virtual console device nodes by tightening /dev/tty* permissions and removing unnecessary local login rights.
- Use seccomp or LSM policies (AppArmor, SELinux) to block the ioctl syscall on tty devices for service accounts that do not require console access.
- Where feasible, disable unused virtual terminals in the kernel configuration or via systemd-logind settings.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
