Summary
[2.4.0-12]
- Fix CVE-2026-72693: openvt -u process matching made more conservative
Resolves: RHEL-235988
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kbd | 0:2.4.0-12.el9_8 |
| Oracle Linux · 9 | kbd-legacy | 0:2.4.0-12.el9_8 |
| Oracle Linux · 9 | kbd-misc | 0:2.4.0-12.el9_8 |
Vulnerabilities 1
-
High 7.8
Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login
`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat(…