{"id":"CVE-2026-72693","aliases":["ALSA-2026:57597","ALSA-2026:57610","ALSA-2026:78951","AZL-95928","CLSA-2026-1788265535","CLSA-2026-1788600455","DEBIAN-CVE-2026-72693","EUVD-2026-55978","GHSA-6766-cx7r-c5q6","MGASA-2026-0444","OESA-2026-3505","RHSA-2026:41136","RHSA-2026:57597","RHSA-2026:57610","RHSA-2026:78951","RLSA-2026:57597","RLSA-2026:57610","RLSA-2026:78951","ROOT-OS-DEBIAN-12-CVE-2026-72693","SUSE-SU-2026:23742-1","SUSE-SU-2026:23844-1","SUSE-SU-2026:23893-1","SUSE-SU-2026:23911-1","SUSE-SU-2026:4207-1","SUSE-SU-2026:4211-1","UBUNTU-CVE-2026-72693","openSUSE-SU-2026:21939-1"],"status":"published","title":"Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login","description":"`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\"/proc/\u003cpid\u003e/fd/0\")`. `stat()` on `/proc/\u003cpid\u003e/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00148,"percentile":0.04029,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2026-08-11T08:39:24Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"kbd","fixed_in":["2.6.4-8.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"kbd-legacy","fixed_in":["2.6.4-8.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"kbd-misc","fixed_in":["2.6.4-8.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"kbd","fixed_in":["2.4.0-12.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"kbd-legacy","fixed_in":["2.4.0-12.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"kbd-misc","fixed_in":["2.4.0-12.el9_8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"kbd","fixed_in":["2.0.4-11.el8_10.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"kbd-legacy","fixed_in":["2.0.4-11.el8_10.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"kbd-misc","fixed_in":["2.0.4-11.el8_10.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kbd","fixed_in":["2.2.0-3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"kbd","fixed_in":["2.4.0-11.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"kbd-legacy","fixed_in":["2.4.0-11.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"kbd-misc","fixed_in":["2.4.0-11.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"kbd","fixed_in":["2.4.0-8.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"kbd-legacy","fixed_in":["2.4.0-8.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"kbd-misc","fixed_in":["2.4.0-8.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kbd","fixed_in":["2.10.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"kbd","fixed_in":["2.9.0-1.1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"kbd","fixed_in":["2.5.1-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"kbd","fixed_in":["2.2.0-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"kbd","fixed_in":["2.5.1-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"kbd","fixed_in":["2.6.1-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"kbd","fixed_in":["2.6.1-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"kbd","fixed_in":["2.6.1-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"kbd","fixed_in":["0:2.10.0-2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"kbd-legacy","fixed_in":["0:2.10.0-2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"kbd-misc","fixed_in":["0:2.10.0-2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"kbd","fixed_in":["0:2.6.4-8.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"kbd-debuginfo","fixed_in":["0:2.6.4-8.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"kbd-debugsource","fixed_in":["0:2.6.4-8.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"kbd-legacy","fixed_in":["0:2.6.4-8.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"kbd-misc","fixed_in":["0:2.6.4-8.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kbd","fixed_in":["0:2.4.0-12.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kbd-debuginfo","fixed_in":["0:2.4.0-12.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kbd-debugsource","fixed_in":["0:2.4.0-12.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kbd-legacy","fixed_in":["0:2.4.0-12.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kbd-misc","fixed_in":["0:2.4.0-12.el9_8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kbd","fixed_in":["0:2.0.4-11.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kbd-debuginfo","fixed_in":["0:2.0.4-11.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kbd-debugsource","fixed_in":["0:2.0.4-11.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kbd-legacy","fixed_in":["0:2.0.4-11.el8_10.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kbd-misc","fixed_in":["0:2.0.4-11.el8_10.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"kbd","fixed_in":["0:2.6.4-8.el10_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"kbd","fixed_in":["0:2.4.0-12.el9_8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"kbd","fixed_in":["0:2.0.4-11.el8_10.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"kbd","fixed_in":["2.5.1-1.aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-kbd","fixed_in":["2.5.1-1.aikido.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"kbd","fixed_in":["2.6.4-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"kbd","fixed_in":["2.6.4-2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"kbd","fixed_in":["2.7.1-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kbd","fixed_in":["2.7.1-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kbd","fixed_in":["2.7.1-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kbd","fixed_in":["2.4.0-150400.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kbd","fixed_in":["2.4.0-150400.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kbd","fixed_in":["2.4.0-150400.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kbd","fixed_in":["2.4.0-150400.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kbd","fixed_in":["2.4.0-150400.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kbd","fixed_in":["2.4.0-150400.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kbd","fixed_in":["2.4.0-150400.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kbd","fixed_in":["2.4.0-150400.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kbd","fixed_in":["2.4.0-150400.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kbd","fixed_in":["2.4.0-150400.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kbd","fixed_in":["2.4.0-150400.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kbd","fixed_in":["2.4.0-150400.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kbd","fixed_in":["2.4.0-150400.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kbd","fixed_in":["2.4.0-150700.15.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"kbd","fixed_in":["2.7.1-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-8.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"kbd-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-8.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"kbd-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-8.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-12.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"kbd-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-12.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"kbd-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-12.el9_8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-11.el8_10.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"kbd-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-11.el8_10.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"kbd-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-11.el8_10.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-11.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kbd-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-11.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"kbd-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-11.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-8.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kbd-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-8.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"kbd-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-8.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0-1","2.5.1-1","2.6.4-1","2.6.4-2","2.6.4-3","2.7.1-1","2.7.1-2","2.7.1-2+exp1","2.7~rc1-1","2.9.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0-1","2.7.1-2","2.7.1-2+exp1","2.9.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-1"}]}],"versions":["2.7.1-2","2.7.1-2+exp1","2.9.0-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-1.1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.0-2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"kbd-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.0-2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"kbd-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.0-2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.4-8.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"kbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.4-8.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"kbd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.4-8.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"kbd-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.4-8.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"kbd-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.4-8.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-12.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-12.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kbd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-12.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kbd-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-12.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"kbd-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-12.el9_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-11.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-11.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kbd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-11.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kbd-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-11.el8_10.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"kbd-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-11.el8_10.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.4-8.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-12.el9_8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-11.el8_10.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1.aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1.aikido.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150700.15.10.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.5-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.5-1ubuntu4","1.15.5-1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.3-2ubuntu3","2.0.4-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.4-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-3ubuntu3","2.3.0-3ubuntu4","2.3.0-3ubuntu4.22.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.1-1ubuntu1","2.6.4-2ubuntu1","2.6.4-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-2ubuntu2","2.9.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-2ubuntu1","2.7.1-2ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-160000.3.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.22"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:41136","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57597","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57610","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60440","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66357","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:78951","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-72693","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2462115","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72693","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6766-cx7r-c5q6"},{"url":"https://bugzilla.redhat.com/2462115","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-57597.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-57610.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-78951.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1788265535.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788600455.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-72693","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0444.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36239","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROE6W66CNK3GP7353HAME3NKIXGBUZ64/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3505","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41136.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72693","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57597.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57610.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_78951.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:57597","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:57610","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:78951","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623742-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1275441","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72693","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623844-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623893-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623911-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264207-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264211-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-72693","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-72693","title":"Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login","description":"`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\"/proc/\u003cpid\u003e/fd/0\")`. `stat()` on `/proc/\u003cpid\u003e/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.","status":"published","published":"2026-08-11T08:39:24.983Z","modified":"2026-11-05T22:41:05.928Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-05T23:55:29.66083Z"}],"euvd":[{"id":"EUVD-2026-55978","description":"`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\"/proc/\u003cpid\u003e/fd/0\")`. `stat()` on `/proc/\u003cpid\u003e/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.","status":"published","published":"2026-08-11T08:39:24Z","modified":"2026-11-05T22:41:05Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T00:02:32.983223Z"}],"ghsa":[{"id":"GHSA-6766-cx7r-c5q6","title":"`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that...","description":"`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\"/proc/\u003cpid\u003e/fd/0\")`. `stat()` on `/proc/\u003cpid\u003e/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.","status":"published","published":"2026-08-11T09:32:35Z","modified":"2026-10-09T06:32:17Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:12:59.985635Z"}],"nvd":[{"id":"CVE-2026-72693","description":"`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\"/proc/\u003cpid\u003e/fd/0\")`. `stat()` on `/proc/\u003cpid\u003e/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.","status":"published","published":"2026-08-11T09:17:14.34Z","modified":"2026-11-05T23:16:59.85Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-06T01:57:39.389848Z"}],"osv":[{"id":"DEBIAN-CVE-2026-72693","description":"`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\"/proc/\u003cpid\u003e/fd/0\")`. `stat()` on `/proc/\u003cpid\u003e/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.","status":"published","published":"2026-08-11T09:17:14.34Z","modified":"2026-11-03T09:47:25.811653842Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"OESA-2026-3505","title":"kbd security update","description":"The  project contains tools for managing Linux console ,including  Linux console,virtual terminals, keyboard, etc, mainly, what they do  is loading console fonts and keyboard maps.\r\n\r\nSecurity Fix(es):\n\n`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\u0026quot;/proc/\u0026lt;pid\u0026gt;/fd/0\u0026quot;)`. `stat()` on `/proc/\u0026lt;pid\u0026gt;/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT.(CVE-2026-72693)","status":"published","published":"2026-08-30T04:14:24Z","modified":"2026-08-30T04:31:43.893690522Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:41136","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-14T10:13:54Z","modified":"2026-10-10T10:10:04Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:57597","title":"Red Hat Security Advisory: kbd security update","status":"published","published":"2026-08-21T10:14:03Z","modified":"2026-10-10T10:14:50Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:57610","title":"Red Hat Security Advisory: kbd security update","status":"published","published":"2026-08-21T10:14:04Z","modified":"2026-10-10T10:14:51Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:78951","title":"Red Hat Security Advisory: kbd security update","status":"published","published":"2026-10-10T10:22:35Z","modified":"2026-10-10T10:35:25.155560547Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:57597","title":"Moderate: kbd security update","description":"The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files.\n\nSecurity Fix(es):\n\n* kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login (CVE-2026-72693)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-21T12:08:17.776256Z","modified":"2026-08-21T12:30:03.565944763Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:57610","title":"Moderate: kbd security update","description":"The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files.\n\nSecurity Fix(es):\n\n* kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login (CVE-2026-72693)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-21T06:06:25.930144Z","modified":"2026-08-21T06:30:04.262766995Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:78951","title":"Moderate: kbd security update","description":"The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files.\n\nSecurity Fix(es):\n\n* kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login (CVE-2026-72693)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-09T06:03:38.053729Z","modified":"2026-10-09T06:45:02.643129365Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-72693","description":"`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\"/proc/\u003cpid\u003e/fd/0\")`. `stat()` on `/proc/\u003cpid\u003e/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.","status":"published","published":"2026-08-11T09:17:00Z","modified":"2026-10-17T13:00:49.046003556Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"ALSA-2026:57597","title":"Moderate: kbd security update","description":"The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files.  \n\nSecurity Fix(es):  \n\n  * kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login (CVE-2026-72693)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-20T00:00:00Z","modified":"2026-10-29T11:30:47.319433952Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:57610","title":"Moderate: kbd security update","description":"The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files.  \n\nSecurity Fix(es):  \n\n  * kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login (CVE-2026-72693)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-20T00:00:00Z","modified":"2026-10-29T11:32:36.658508298Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:78951","title":"Moderate: kbd security update","description":"The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files.  \n\nSecurity Fix(es):  \n\n  * kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login (CVE-2026-72693)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-29T11:00:51.475786584Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-95928","title":"CVE-2026-72693 affecting package kbd for versions less than 2.2.0-3","description":"`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\"/proc/\u003cpid\u003e/fd/0\")`. `stat()` on `/proc/\u003cpid\u003e/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.","status":"published","published":"2026-08-11T09:17:14Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"CLSA-2026-1788265535","title":"kbd: Fix of CVE-2026-72693","description":"- CVE-2026-72693: require a matching process owner and controlling\n  terminal when openvt -u determines the current VT owner, instead of\n  trusting the ownership of an inherited file descriptor, and refuse\n  root as a pre-authenticated target. The old check could be satisfied\n  by a process not owned by the VT owner, starting login -f for the\n  wrong user without a password.","status":"published","published":"2026-09-01T12:25:45Z","modified":"2026-10-26T09:31:28.908652267Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788600455","title":"kbd: Fix of CVE-2026-72693","description":"- CVE-2026-72693: fix openvt -u process ownership validation","status":"published","published":"2026-09-05T09:27:46Z","modified":"2026-10-26T09:30:45.960399001Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"MGASA-2026-0444","title":"Updated kbd packages fix a security vulnerability","description":"Local privilege escalation in openvt via incorrect process owner\nverification allowing passwordless root login. (CVE-2026-72693)\n","status":"published","published":"2026-09-24T02:02:40Z","modified":"2026-09-24T02:15:05.008481884Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:21939-1","title":"Security update for kbd","description":"This update for kbd fixes the following issue:\n\n- CVE-2026-72693: local privilege escalation in `openvt` due to incorrect process owner verification that allows\n  `passwordless` root login (bsc#1275441).\n","status":"published","published":"2026-09-23T19:45:21Z","modified":"2026-09-25T18:23:14.233875987Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-72693","title":"CVE-2026-72693 in kbd - Patched by Root","description":"Root has patched CVE-2026-72693 in the kbd package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-06T08:34:55Z","modified":"2026-10-06T09:15:02.976111314Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"SUSE-SU-2026:23742-1","title":"Security update for kbd","description":"This update for kbd fixes the following issue:\n\n- CVE-2026-72693: local privilege escalation in `openvt` due to incorrect process owner verification that allows\n  `passwordless` root login (bsc#1275441).\n","status":"published","published":"2026-09-16T09:15:26Z","modified":"2026-09-27T18:23:10.671709484Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23844-1","title":"Security update for kbd","description":"This update for kbd fixes the following issue:\n\n- CVE-2026-72693: local privilege escalation in `openvt` due to incorrect process owner verification that allows\n  `passwordless` root login (bsc#1275441).\n","status":"published","published":"2026-09-16T09:12:51Z","modified":"2026-09-27T18:23:15.389381061Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23893-1","title":"Security update for kbd","description":"This update for kbd fixes the following issue:\n\n- CVE-2026-72693: local privilege escalation in `openvt` due to incorrect process owner verification that allows\n  `passwordless` root login (bsc#1275441).\n","status":"published","published":"2026-09-23T19:47:23Z","modified":"2026-09-30T18:23:11.296457022Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23911-1","title":"Security update for kbd","description":"This update for kbd fixes the following issue:\n\n- CVE-2026-72693: local privilege escalation in `openvt` due to incorrect process owner verification that allows\n  `passwordless` root login (bsc#1275441).\n","status":"published","published":"2026-09-23T19:47:23Z","modified":"2026-09-30T18:23:12.526070334Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:4207-1","title":"Security update for kbd","description":"This update for kbd fixes the following issue:\n\n- CVE-2026-72693: local privilege escalation in `openvt` due to incorrect process owner verification that allows\n  `passwordless` root login (bsc#1275441).\n","status":"published","published":"2026-09-16T08:22:44Z","modified":"2026-09-16T21:45:07.144114511Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4211-1","title":"Security update for kbd","description":"This update for kbd fixes the following issue:\n\n- CVE-2026-72693: local privilege escalation in `openvt` due to incorrect process owner verification that allows\n  `passwordless` root login (bsc#1275441).\n","status":"published","published":"2026-09-16T11:51:08Z","modified":"2026-09-16T21:45:03.603618436Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}