Summary
[2.6.4-8]
- Fix openvt -u process matching to be more conservative (CVE-2026-72693)
Resolves: RHEL-235987
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | kbd | 0:2.6.4-8.el10_2 |
| Oracle Linux · 10 | kbd-legacy | 0:2.6.4-8.el10_2 |
| Oracle Linux · 10 | kbd-misc | 0:2.6.4-8.el10_2 |
Vulnerabilities 1
-
High 7.8
Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login
`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat(…