Summary
The kbd packages provide tools for managing console behavior on a Linux system, including the keyboard, screen fonts, virtual terminals, and font files.
Security Fix(es):
* kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login (CVE-2026-72693)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | kbd | 2.4.0-12.el9_8 |
| AlmaLinux · 9 | kbd-legacy | 2.4.0-12.el9_8 |
| AlmaLinux · 9 | kbd-misc | 2.4.0-12.el9_8 |
Vulnerabilities 1
-
High 7.8
Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login
`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat(…