Security update for kbd
A local privilege escalation vulnerability (CVE-2026-72693) exists in the 'openvt' component of the kbd package due to incorrect process owner verification. This flaw allows passwordless root login. The issue affects Red Hat Hardened Images and related kbd packages. A security update has been issued by Red Hat to address this vulnerability.
AI Analysis
Technical Summary
CVE-2026-72693 is a local privilege escalation vulnerability in the 'openvt' utility of the kbd package caused by improper verification of the process owner. This flaw enables an attacker to gain root access without a password. Red Hat has released updated kbd packages (version 2.10.0-2.hum1) for multiple architectures to remediate this issue. The vulnerability is tracked under bug bsc#1275441 and CWE-284 (Improper Access Control).
Potential Impact
Successful exploitation of this vulnerability allows a local user to escalate privileges to root without authentication, potentially compromising the entire system's security. This is a high severity issue due to the ability to gain unauthorized root access.
Mitigation Recommendations
Red Hat has released fixed versions of the kbd packages (kbd-2.10.0-2.hum1 and related packages) that address this vulnerability. Users should apply the available security updates from Red Hat Hardened Images repositories as detailed in the Red Hat advisory RHSA-2026:41136. No additional mitigation steps are required beyond applying the official update.
Security update for kbd
Description
A local privilege escalation vulnerability (CVE-2026-72693) exists in the 'openvt' component of the kbd package due to incorrect process owner verification. This flaw allows passwordless root login. The issue affects Red Hat Hardened Images and related kbd packages. A security update has been issued by Red Hat to address this vulnerability.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-72693 is a local privilege escalation vulnerability in the 'openvt' utility of the kbd package caused by improper verification of the process owner. This flaw enables an attacker to gain root access without a password. Red Hat has released updated kbd packages (version 2.10.0-2.hum1) for multiple architectures to remediate this issue. The vulnerability is tracked under bug bsc#1275441 and CWE-284 (Improper Access Control).
Potential Impact
Successful exploitation of this vulnerability allows a local user to escalate privileges to root without authentication, potentially compromising the entire system's security. This is a high severity issue due to the ability to gain unauthorized root access.
Mitigation Recommendations
Red Hat has released fixed versions of the kbd packages (kbd-2.10.0-2.hum1 and related packages) that address this vulnerability. Users should apply the available security updates from Red Hat Hardened Images repositories as detailed in the Red Hat advisory RHSA-2026:41136. No additional mitigation steps are required beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:41136
- Cve Count
- 1
- State
- PUBLISHED
Threat ID: 6a81d6f4bf8831d53949f885
Added to database: 08/16/2026, 15:27:48 UTC
Last enriched: 09/30/2026, 16:28:17 UTC
Last updated: 10/01/2026, 05:08:54 UTC
Views: 40
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.