openvt EUVD-2026-55978

Exploitation requires that openvt -u (typically invoked as openvt -us) is configured in the system's kbrequest/init execution path - a non-default, explicitly configured deployment. The attacker must be a local user with the ability to spawn a process that holds file descriptor 0 open on a specific virtual terminal. The attack window opens only after a privileged user logs out from that TTY, causing the TTY character device node ownership to revert to root or the getty owner, while the attacker's process simultaneously retains fd 0 on the same device. Systems that do not configure kbrequest/init with openvt -us are explicitly out of scope per the CVE description. Limiting factors include: local access required (no remote vector), the specific kbrequest/init configuration must be present, a privileged session on the target VT must terminate to trigger the ownership reversion, and the attacker must maintain a process on the correct VT through that transition window.

The official CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly anchors this as a local privilege escalation to root with low prior privileges and full system impact. The AC:L designation, however, may understate practical difficulty: achieving the required state - an attacker process holding fd 0 on a TTY through the ownership-reversion window after a privileged logout - is environmentally dependent and not universally reproducible without some control over or foreknowledge of session lifecycle on the target VT. Critically, the CVE description explicitly limits the reachable attack surface to systems deploying openvt -us from a privileged kbrequest/init path, which is a non-default configuration. No EPSS score, CISA KEV listing, or POC is present in the available data, indicating no confirmed or widespread exploitation at time of analysis. The aggregate risk profile is: high impact if conditions are met, but bounded threat surface limited to specific RHEL-family systems with the kbrequest/init openvt -us configuration. Organizations not using this deployment pattern are unaffected per the CVE's own scope statement.

A local unprivileged attacker on a RHEL system configured with openvt -us in the kbrequest/init path opens or retains a background process with file descriptor 0 attached to a target virtual terminal. When a privileged user subsequently logs out from that VT - causing the TTY device node ownership to revert to root - the attacker triggers or waits for openvt -u to be invoked via the kbrequest handler. The authenticate_user() check reads the now-root-owned device node UID via stat("/proc/<attacker-pid>/fd/0"), incorrectly concludes the attacker's process belongs to the root console owner, and executes login -f root on the spawned VT, granting an interactive root shell without a password.