Skip to main content

openvt CVE-2026-72693

| EUVDEUVD-2026-55978 HIGH
Improper Access Control (CWE-284)
2026-08-11 redhat GHSA-6766-cx7r-c5q6
Authentication Bypass Privilege Escalation Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Red Hat Hardened Images Red Hat
7.8
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

AC:H reflects the required combination of specific kbrequest/init deployment, attacker fd-0 retention, and timed TTY ownership reversion; all other metrics align with the official vector.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.8 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 11, 2026 - 09:31 vuln.today
CVE Published
Aug 11, 2026 - 08:39 nvd
HIGH 7.8

DescriptionCVE.org

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticate_user() relies on stat("/proc/<pid>/fd/0"). stat() on /proc/<pid>/fd/0 follows the symlink to the underlying TTY device node. As a result, buf.st_uid reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to root or the getty owner after logout while an unprivileged process still has fd 0 attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the -u path executes a passwordless login as the selected user. In the documented kbrequest/init deployment using openvt -us, this can result in passwordless login -f root on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use openvt -u from a privileged kbrequest/init path.

AnalysisAI

Privilege escalation in the openvt -u utility allows a local low-privileged attacker to obtain passwordless root login on Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The flaw lies in authenticate_user(), which resolves VT ownership via stat("/proc/<pid>/fd/0") - a call that follows the symlink to the underlying TTY device node rather than inspecting the owning process, causing the check to read the device node's UID rather than the process owner's UID. When a privileged user logs out and TTY device node ownership reverts to root or the getty owner while an attacker's process still holds fd 0 on that TTY, the check incorrectly authorizes a passwordless login -f root execution. No public exploit is identified at time of analysis and there is no CISA KEV listing, but the root-level impact makes this a high priority for environments using the affected kbrequest/init deployment pattern.

Technical ContextAI

The openvt utility, typically distributed as part of the kbd package on Red Hat-based systems, provides a means of running commands on virtual terminals. Its -u flag enables a privileged ownership-check mode, and -s switches to the identified user's VT before executing login -f as that user - the intended use case being a kbrequest/init handler. The root cause (CWE-284: Improper Access Control) is a symlink-following side effect: stat("/proc/<pid>/fd/0") resolves through the /proc filesystem symlink to the underlying character device node (e.g., /dev/tty1), returning the device node's st_uid rather than any process-ownership attribute. TTY device node ownership is dynamically set to the logged-in user by login/getty and reverts to root or the getty UID after session termination. This creates a post-logout window in which any unprivileged process that retained fd 0 on that TTY will pass the ownership check, because the device node now appears to be owned by root. Affected CPE strings confirm the vulnerable surface spans Red Hat Enterprise Linux 6, 7, 8, 9, and 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4.

RemediationAI

The primary remediation is to apply the vendor-issued errata package from Red Hat once released, tracked at https://access.redhat.com/security/cve/CVE-2026-72693 and https://bugzilla.redhat.com/show_bug.cgi?id=2462115; no specific fixed version number is confirmed in currently available data, so monitor the Bugzilla ticket for package update announcements. As an immediate compensating control, audit whether any inittab, systemd unit, or init script invokes openvt -u or openvt -us from a kbrequest or equivalent privileged handler; if this functionality is not operationally required, remove or comment out the kbrequest action to eliminate the privilege escalation path entirely - this has the trade-off of disabling console-level keyboard-triggered VT switching from init. Where the kbrequest behavior is needed, consider replacing openvt -us with a wrapper that performs process-ownership verification via /proc/<pid>/status (reading Uid: fields) rather than relying on stat() of fd 0. SELinux policy enforcement on RHEL systems can be used to restrict openvt execution contexts and deny login -f invocations from unexpected parent processes, providing defense-in-depth without disabling the feature.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 9 Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected

Share

CVE-2026-72693 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy