The vulnerability in openvt (part of the kbd package) stems from the authenticate_user() function using stat() on /proc/<pid>/fd/0 to verify process ownership. Because stat() follows the symlink to the underlying TTY device node, the ownership check uses the TTY node owner rather than the actual process owner. If the TTY ownership returns to root or getty after logout but an unprivileged process still holds fd 0 on that TTY, the check can mistakenly treat that process as privileged. This allows the openvt -u path to execute a passwordless login as the selected user, potentially root, leading to local privilege escalation. Exploitation requires a non-default kbrequest/init configuration explicitly invoking openvt -u and a precise timing condition. Standard Red Hat deployments do not use this configuration, limiting exposure. Red Hat has published an advisory but no official fix or patch is currently available.

Successful exploitation allows a local unprivileged attacker to gain passwordless root login on the system, resulting in full system compromise. However, exploitation requires a deliberately configured kbrequest/init setup using openvt -u and a narrow race condition involving TTY ownership, which is not present in default Red Hat Enterprise Linux 10 installations. Therefore, the practical impact is limited to environments with this specific configuration.

Red Hat advises avoiding the use of openvt -u in privileged kbrequest/init deployments. Instead, configure kbrequest to initiate a standard authenticated login on the new virtual terminal or disable the keyboard request binding entirely until a fix is available. Changes to kbrequest configurations may require a system restart or service reload. No official patch or fix has been released yet; patch status is not confirmed. Users should monitor the Red Hat advisory for updates.