CVE-2026-72693: 
Linux Red Hat Analyse et atténuation des vulnérabilités

CVE-2026-72693 is a local privilege escalation vulnerability in openvt (part of the kbd package) that allows a low-privileged local attacker to achieve passwordless root login under specific deployment conditions. The flaw exists in the authenticate_user() function, which incorrectly uses TTY device node ownership rather than process ownership to authorize privileged login. It was reported on April 26, 2026, and publicly disclosed on August 11, 2026. Affected products include the kbd package across Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 (via rhcos). The CVSS v3.1 base score is 7.8 (High), though Red Hat rates real-world impact as Moderate due to non-default configuration requirements (Red Hat CVE, Red Hat Bugzilla).

The root cause is CWE-284 (Improper Access Control): the authenticate_user() function in src/openvt.c calls stat("/proc/<pid>/fd/0"), which follows the symlink to the underlying TTY device node. This means buf.st_uid reflects the TTY device owner, not the owner of the process holding the file descriptor. After a user logs out, TTY ownership reverts to root or the getty owner; if an unprivileged process still holds fd 0 open on that TTY, the ownership check incorrectly matches, and openvt proceeds to execute execlp("login", "login", "-f", username, NULL) — a passwordless login as the identified user. Exploitation requires a non-default kbrequest/init configuration (e.g., kb::kbrequest:/usr/bin/openvt -us) and the ability to keep a background process attached to the originating VT while triggering the keyboard request (Red Hat Bugzilla, Red Hat CVE).

The vulnerable code pattern is:

while ((dentp = readdir(dp))) {
    sprintf(filename, "/proc/%s/fd/0", dentp->d_name);
    if (stat(filename, &buf)) continue;
    if (buf.st_dev == console_dev && buf.st_ino == console_ino &&
        buf.st_uid == console_uid)
        goto got_a_process;
}

The proposed fix adds a prior stat() on /proc/<pid> itself to validate the actual process owner before checking the TTY file descriptor (Red Hat Bugzilla).

Successful exploitation grants a local unprivileged attacker full root access on the affected system, resulting in complete compromise of confidentiality, integrity, and availability. An attacker with root access can read all system data, modify or destroy system state, install rootkits or backdoors, and disrupt services. The impact is scoped to the local system and does not directly enable network-based lateral movement, but root access on a compromised host can facilitate further attacks within the environment (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is approximately 0.001 (0.1%), reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, a deliberately configured kbrequest/init setup invoking openvt -u, and a timing condition where an unprivileged process retains fd 0 on the TTY after logout — a combination not present in standard Red Hat deployments (Red Hat CVE).

1. Verify target configuration: Confirm the system uses a kbrequest/init configuration that invokes openvt -u, such as kb::kbrequest:/usr/bin/openvt -us in /etc/inittab or equivalent init configuration.
2. Set up keyboard mapping: Load a keyboard mapping that binds a key combination to the Spawn_Console action, e.g., echo "alt keycode 103 = Spawn_Console" | loadkeys.
3. Log in as unprivileged user: Authenticate as a low-privileged user on tty1 (or the target VT).
4. Anchor a background process to the TTY: Launch a long-running background process that keeps fd 0 attached to the current TTY: nohup sh -c 'sleep 1000000' </dev/tty1 >/dev/null 2>&1 &.
5. Log out: Log out from tty1, causing TTY ownership to revert to root or the getty owner, while the background process retains its open file descriptor.
6. Trigger the keyboard request: Press the configured key combination (e.g., Alt+Up Arrow) to invoke the kbrequest action, causing openvt -us to run with root privileges.
7. Observe passwordless root login: The authenticate_user() check matches the background process's fd 0 against the now-root-owned TTY, passes the ownership check, and executes login -f root on the new VT — granting a root shell without a password (Red Hat Bugzilla).

• Logs: Entries in /var/log/auth.log or journald showing login -f root invocations without a preceding password authentication event; unexpected openvt process executions logged by the init system.
• Process: Presence of long-running background processes (e.g., sleep, sh) owned by an unprivileged user with fd 0 pointing to a TTY device (/proc/<pid>/fd/0 symlink resolving to /dev/tty*) after that user has logged out.
• File System: Unexpected modifications to /etc/inittab or systemd unit files enabling kbrequest with openvt -u; new keyboard mapping files loaded via loadkeys.
• Network: Unexpected outbound connections from a root-owned shell process spawned on a virtual terminal, potentially indicating post-exploitation activity (Red Hat Bugzilla).

Red Hat's primary mitigation is to avoid using openvt -u in privileged kbrequest/init deployments. Administrators should reconfigure the keyboard request to initiate a standard authenticated login on the new virtual terminal rather than using login -f, or disable the kbrequest binding entirely until a package fix is released. A tracker for a fix in RHEL 10.3 has been filed (RHEL-189241). The proposed code fix involves validating the actual process owner via stat("/proc/<pid>") before checking the TTY file descriptor, ensuring buf.st_uid reflects the process owner rather than the TTY device owner. Configuration changes to kbrequest may require a system restart or service reload to take effect (Red Hat CVE, Red Hat Bugzilla).

Red Hat rates the real-world impact as Moderate despite the 7.8 High CVSS score, noting that exploitation requires a non-default kbrequest/init configuration and a specific TTY-state timing condition not present in standard Red Hat deployments. The vulnerability was discovered by "AISLE" in partnership with Red Hat and was reported under embargo before public disclosure. Brief social media coverage appeared on Mastodon via @thehackerwire shortly after disclosure, and the vulnerability was indexed by multiple threat intelligence aggregators including VulDB, Vulners, and INCIBE-CERT (Red Hat CVE, Red Hat Bugzilla).