{"id":"CVE-2026-72693","title":"`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context","summary":"`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\"/proc…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-284"],"vendor":"Red Hat","product":"kbd","affected":["kbd (all versions)","kbd (all versions)","rhcos (all versions)","rhcos (all versions)","kbd-main (all versions)","kbd","kbd (all versions)","kbd (all versions)","openshift/ose-rhel-coreos-9 (all versions)"],"published":"2026-08-11","updated":"2026-09-15","sourceUpdated":"2026-09-15T12:17:53.320","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72693","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:41136","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:57597","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:57610","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:60440","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:66357","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-72693","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2462115","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72693.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72693"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72693"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-08-11T17:44:26.656399Z"},"epss":0.00107,"epssPercentile":0.01308,"ingestedAt":"2026-09-15T12:36:50.169Z","patched":["openshift_container_platform 4.22","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","hardened_images"],"slug":"CVE-2026-72693","body":"## Overview\n\n`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat(\"/proc/<pid>/fd/0\")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:60440** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:60440)\n- **RHSA-2026:66357** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66357)\n- **RHSA-2026:57597** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57597)\n- **RHSA-2026:57610** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57610)\n- **RHSA-2026:41136** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41136)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72693.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}