CVE-2026-72693 is a local privilege escalation vulnerability in openvt (kbd package) where the ownership verification of the process is flawed. The authenticate_user() function relies on stat("/proc/<pid>/fd/0") which returns the owner of the TTY device node, not the actual process owner. If the TTY ownership returns to root after logout while an unprivileged process still holds fd 0, the check can incorrectly authenticate the unprivileged process as the privileged console owner. This leads to passwordless login as root when openvt -u is used in kbrequest/init. Exploitation requires a non-default kbrequest/init configuration invoking openvt -u and a specific timing race condition. Standard Red Hat product deployments do not have this configuration, limiting real-world impact. Red Hat recommends avoiding openvt -u in privileged contexts or disabling the keyboard request binding until a fix is available.

The vulnerability allows a local unprivileged attacker to escalate privileges to root without a password under specific conditions involving a non-default kbrequest/init configuration and a timing race condition with TTY ownership. The impact is high in a technical sense (passwordless root login), but real-world exploitation is constrained by the need for deliberate configuration and timing, resulting in a moderate overall impact rating by Red Hat.

Red Hat advises avoiding the use of openvt -u in privileged kbrequest/init deployments. Instead, configure kbrequest to initiate a standard authenticated login on the new virtual terminal or disable the keyboard request binding entirely until a fix is available. Changes to kbrequest configurations may require a system restart or service reload. No official patch is currently indicated; mitigation relies on configuration changes.